From w3c-dist-auth-request@w3.org  Mon Sep  1 06:56:44 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA04013
	for <webdav-archive@lists.ietf.org>; Mon, 1 Sep 2003 06:56:44 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 404D5A0660; Mon,  1 Sep 2003 06:55:28 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id B9A12A0B75
	for <w3c-dist-auth@frink.w3.org>; Mon,  1 Sep 2003 06:55:24 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 7795813C10; Mon,  1 Sep 2003 06:55:24 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from server8a.software-ag.de (server8a.software-ag.de [193.26.193.47])
	by dr-nick.w3.org (Postfix) with ESMTP id CEA5113916
	for <w3c-dist-auth@w3c.org>; Mon,  1 Sep 2003 06:55:23 -0400 (EDT)
Received: from daehub01.software-ag.de by server8a.software-ag.de; (8.11.6/8.9.3)
	id h81AtK331785; Mon, 1 Sep 2003 12:55:21 +0200
Received: by daehub01.software-ag.de with Internet Mail Service (5.5.2653.19)
	id <RTLMZV0S>; Mon, 1 Sep 2003 12:55:20 +0200
Message-ID: <DFF2AC9E3583D511A21F0008C7E6210605C48060@daemsg02.software-ag.de>
From: "Nevermann, Dr., Peter" <Peter.Nevermann@softwareag.com>
To: "'w3c-dist-auth@w3c.org'" <w3c-dist-auth@w3c.org>
Date: Mon, 1 Sep 2003 12:55:15 +0200 
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C37077.8656A3F0"
Subject: BIND and write locks
X-Archived-At: http://www.w3.org/mid/DFF2AC9E3583D511A21F0008C7E6210605C48060@daemsg02.software-ag.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7840
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030901105528.404D5A0660@frink.w3.org>
Resent-Date: Mon,  1 Sep 2003 06:55:28 -0400 (EDT)


This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C37077.8656A3F0
Content-Type: text/plain;
	charset="iso-8859-1"

I am trying to figure out, how write locks should behave WRT binding.

Take the following scenario:
- a collection C11
- a collection C1 containing a binding "foo" to C11 and mapped to URI "u1"
- a resource R2
- a collection C2 containing a binding "b" to R2 and mapped to URI "u2"

   u1|
     C1
  foo|    |u2
    C11   C2
          |b
          R2

Now the following requests are issued (' marks locked resources):
- LOCK /u1 (write, exclusive, depth=infinity)
  --> C11 is automatically added to the write-lock
- PUT /u1/foo/a (passing locktoken)
  --> creates R1 which is added to the write-lock (RFC2518, Section 7.5)
- BIND /u1/foo (b->/u2/b, passing locktoken)
  --> R2 is added to the write-lock (RFC2518, Section 7.5)

   u1|
     C1'
  foo|    |u2
    C11'  C2
    a| b\ |b
     R1'  R2'

- REBIND /u2 (a->/u1/foo/a, passing locktoken)
  --> R1 is removed from the write-lock (RFC2518, Section 7.7)

   u1|
     C1'
  foo|    |u2
    C11'  C2
       b\ |b \a
          R2' R1

The described behavior for BIND and REBIND is what I suppose it should be.
Is it correct?

BTW, what happens if, afterwards, the following UNLOCK on R2 is issued:
- UNLOCK /u1/foo/b (passing locktoken)
  --> a) request is rejected, UNLOCK must be issued of C1 (/u1)
  or
  --> b) all associated resources (C1, C11, R2) are unlocked (RFC2518,
Section 8.10.4)

I suppose, that it is not possible to remove single resources from the
write-lock by means of UNLOCK, isn't it?

Thanks,
Peter


P.S.:
At http://www.webdav.org/specs/ I found a link to
http://ftp.ics.uci.edu/pub/ietf/webdav/collection/bind-issues.html, which
contains the following entry:

   "ID: 41
   Source: Reuter/Hunt
   Description: Specify how BIND interacts with a write lock.
   Status: Closed
   Resolution: Declined
   Locking semantics is in too confused a state currently to
   be able to make any reliable statements. Don't want to hold
   up binding spec till lock settles down."

Is that still prevailing?

------_=_NextPart_001_01C37077.8656A3F0
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2653.12">
<TITLE>BIND and write locks</TITLE>
</HEAD>
<BODY>

<P><FONT SIZE=3D2>I am trying to figure out, how write locks should =
behave WRT binding.</FONT>
</P>

<P><FONT SIZE=3D2>Take the following scenario:</FONT>
<BR><FONT SIZE=3D2>- a collection C11</FONT>
<BR><FONT SIZE=3D2>- a collection C1 containing a binding =
&quot;foo&quot; to C11 and mapped to URI &quot;u1&quot;</FONT>
<BR><FONT SIZE=3D2>- a resource R2</FONT>
<BR><FONT SIZE=3D2>- a collection C2 containing a binding &quot;b&quot; =
to R2 and mapped to URI &quot;u2&quot;</FONT>
</P>

<P><FONT SIZE=3D2>&nbsp;&nbsp; u1|</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp; C1</FONT>
<BR><FONT SIZE=3D2>&nbsp; foo|&nbsp;&nbsp;&nbsp; |u2</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; C11&nbsp;&nbsp; C2</FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
|b</FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =
R2</FONT>
</P>

<P><FONT SIZE=3D2>Now the following requests are issued (' marks locked =
resources):</FONT>
<BR><FONT SIZE=3D2>- LOCK /u1 (write, exclusive, =
depth=3Dinfinity)</FONT>
<BR><FONT SIZE=3D2>&nbsp; --&gt; C11 is automatically added to the =
write-lock</FONT>
<BR><FONT SIZE=3D2>- PUT /u1/foo/a (passing locktoken)</FONT>
<BR><FONT SIZE=3D2>&nbsp; --&gt; creates R1 which is added to the =
write-lock (RFC2518, Section 7.5)</FONT>
<BR><FONT SIZE=3D2>- BIND /u1/foo (b-&gt;/u2/b, passing =
locktoken)</FONT>
<BR><FONT SIZE=3D2>&nbsp; --&gt; R2 is added to the write-lock =
(RFC2518, Section 7.5)</FONT>
</P>

<P><FONT SIZE=3D2>&nbsp;&nbsp; u1|</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp; C1'</FONT>
<BR><FONT SIZE=3D2>&nbsp; foo|&nbsp;&nbsp;&nbsp; |u2</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; C11'&nbsp; C2</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; a| b\ |b</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp; R1'&nbsp; R2'</FONT>
</P>

<P><FONT SIZE=3D2>- REBIND /u2 (a-&gt;/u1/foo/a, passing =
locktoken)</FONT>
<BR><FONT SIZE=3D2>&nbsp; --&gt; R1 is removed from the write-lock =
(RFC2518, Section 7.7)</FONT>
</P>

<P><FONT SIZE=3D2>&nbsp;&nbsp; u1|</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp; C1'</FONT>
<BR><FONT SIZE=3D2>&nbsp; foo|&nbsp;&nbsp;&nbsp; |u2</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; C11'&nbsp; C2</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; b\ |b \a</FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; R2' =
R1</FONT>
</P>

<P><FONT SIZE=3D2>The described behavior for BIND and REBIND is what I =
suppose it should be. Is it correct?</FONT>
</P>

<P><FONT SIZE=3D2>BTW, what happens if, afterwards, the following =
UNLOCK on R2 is issued:</FONT>
<BR><FONT SIZE=3D2>- UNLOCK /u1/foo/b (passing locktoken)</FONT>
<BR><FONT SIZE=3D2>&nbsp; --&gt; a) request is rejected, UNLOCK must be =
issued of C1 (/u1)</FONT>
<BR><FONT SIZE=3D2>&nbsp; or</FONT>
<BR><FONT SIZE=3D2>&nbsp; --&gt; b) all associated resources (C1, C11, =
R2) are unlocked (RFC2518, Section 8.10.4)</FONT>
</P>

<P><FONT SIZE=3D2>I suppose, that it is not possible to remove single =
resources from the write-lock by means of UNLOCK, isn't it?</FONT>
</P>

<P><FONT SIZE=3D2>Thanks,</FONT>
<BR><FONT SIZE=3D2>Peter</FONT>
</P>
<BR>

<P><FONT SIZE=3D2>P.S.:</FONT>
<BR><FONT SIZE=3D2>At <A HREF=3D"http://www.webdav.org/specs/" =
TARGET=3D"_blank">http://www.webdav.org/specs/</A> I found a link to <A =
HREF=3D"http://ftp.ics.uci.edu/pub/ietf/webdav/collection/bind-issues.ht=
ml" =
TARGET=3D"_blank">http://ftp.ics.uci.edu/pub/ietf/webdav/collection/bind=
-issues.html</A>, which contains the following entry:</FONT></P>

<P><FONT SIZE=3D2>&nbsp;&nbsp; &quot;ID: 41</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp; Source: Reuter/Hunt</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp; Description: Specify how BIND interacts =
with a write lock.</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp; Status: Closed</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp; Resolution: Declined</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp; Locking semantics is in too confused a =
state currently to</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp; be able to make any reliable =
statements. Don't want to hold</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp; up binding spec till lock settles =
down.&quot;</FONT>
</P>

<P><FONT SIZE=3D2>Is that still prevailing?</FONT>
</P>

</BODY>
</HTML>
------_=_NextPart_001_01C37077.8656A3F0--



From w3c-dist-auth-request@w3.org  Mon Sep  1 22:28:36 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA24685
	for <webdav-archive@lists.ietf.org>; Mon, 1 Sep 2003 22:28:36 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 5BB12A0DB9; Mon,  1 Sep 2003 22:28:31 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 2B215A0DB9
	for <w3c-dist-auth@frink.w3.org>; Mon,  1 Sep 2003 22:28:30 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id C5DEC13EB7; Mon,  1 Sep 2003 22:28:22 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from e1.ny.us.ibm.com (e1.ny.us.ibm.com [32.97.182.101])
	by dr-nick.w3.org (Postfix) with ESMTP id ACA9113EB3
	for <w3c-dist-auth@w3.org>; Mon,  1 Sep 2003 22:28:22 -0400 (EDT)
Received: from northrelay02.pok.ibm.com (northrelay02.pok.ibm.com [9.56.224.150])
	by e1.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h822SMbe132140
	for <w3c-dist-auth@w3.org>; Mon, 1 Sep 2003 22:28:22 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay02.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h822SLUJ139154
	for <w3c-dist-auth@w3.org>; Mon, 1 Sep 2003 22:28:21 -0400
In-Reply-To: <DFF2AC9E3583D511A21F0008C7E6210605C48060@daemsg02.software-ag.de>
To: " webdav" <w3c-dist-auth@w3.org>
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Message-ID: <OF191B5874.82524F21-ON85256D95.000CEAFA-85256D95.000D9281@us.ibm.com>
Date: Mon, 1 Sep 2003 22:28:15 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF1|June 9, 2003) at
 09/01/2003 22:28:22,
	Serialize complete at 09/01/2003 22:28:22
Content-Type: multipart/alternative; boundary="=_alternative 000D84D485256D95_="
Subject: Re: BIND and write locks
X-Archived-At: http://www.w3.org/mid/OF191B5874.82524F21-ON85256D95.000CEAFA-85256D95.000D9281@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7841
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030902022831.5BB12A0DB9@frink.w3.org>
Resent-Date: Mon,  1 Sep 2003 22:28:31 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 000D84D485256D95_=
Content-Type: text/plain; charset="US-ASCII"

Peter wrote on 09/01/2003 06:55:15 AM:

> I am trying to figure out, how write locks should behave WRT binding. 
> Take the following scenario: 
> - a collection C11 
> - a collection C1 containing a binding "foo" to C11 and mapped to URI 
"u1" 
> - a resource R2 
> - a collection C2 containing a binding "b" to R2 and mapped to URI "u2" 
>    u1| 
>      C1 
>   foo|    |u2 
>     C11   C2 
>           |b 
>           R2 
> Now the following requests are issued (' marks locked resources): 
> - LOCK /u1 (write, exclusive, depth=infinity) 
>   --> C11 is automatically added to the write-lock 
> - PUT /u1/foo/a (passing locktoken) 
>   --> creates R1 which is added to the write-lock (RFC2518, Section 7.5) 

> - BIND /u1/foo (b->/u2/b, passing locktoken) 
>   --> R2 is added to the write-lock (RFC2518, Section 7.5) 
>    u1| 
>      C1' 
>   foo|    |u2 
>     C11'  C2 
>     a| b\ |b 
>      R1'  R2' 
> - REBIND /u2 (a->/u1/foo/a, passing locktoken) 
>   --> R1 is removed from the write-lock (RFC2518, Section 7.7) 
>    u1| 
>      C1' 
>   foo|    |u2 
>     C11'  C2 
>        b\ |b \a 
>           R2' R1 
> The described behavior for BIND and REBIND is what I suppose it 
> should be. Is it correct? 

Yes.

> BTW, what happens if, afterwards, the following UNLOCK on R2 is issued: 
> - UNLOCK /u1/foo/b (passing locktoken) 
>   --> a) request is rejected, UNLOCK must be issued of C1 (/u1) 
>   or 
>   --> b) all associated resources (C1, C11, R2) are unlocked 
> (RFC2518, Section 8.10.4) 

Several of us have strongly advocated (a), to avoid a client mistakenly
unlocking a whole tree of resources when they intended to unlock a
single resource.  I don't believe this has been resolved though.

> I suppose, that it is not possible to remove single resources from 
> the write-lock by means of UNLOCK, isn't it? 

That is correct, it is not possible.

> P.S.: 
> At http://www.webdav.org/specs/ I found a link to http://ftp.ics.
> uci.edu/pub/ietf/webdav/collection/bind-issues.html, which contains 
> the following entry:
>    "ID: 41 
>    Source: Reuter/Hunt 
>    Description: Specify how BIND interacts with a write lock. 
>    Status: Closed 
>    Resolution: Declined 
>    Locking semantics is in too confused a state currently to 
>    be able to make any reliable statements. Don't want to hold 
>    up binding spec till lock settles down." 
> Is that still prevailing? 

No, that is an obsolete document, and it (and any links to it) should
be removed.  The current bind issues document is:

http://www.webdav.org/bind/bind-issues-list.htm

Cheers,
Geoff

--=_alternative 000D84D485256D95_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2><tt>Peter wrote on 09/01/2003 06:55:15 AM:<br>
<br>
&gt; I am trying to figure out, how write locks should behave WRT binding.
</tt></font>
<br><font size=2><tt>&gt; Take the following scenario: <br>
&gt; - a collection C11 <br>
&gt; - a collection C1 containing a binding &quot;foo&quot; to C11 and
mapped to URI &quot;u1&quot; <br>
&gt; - a resource R2 <br>
&gt; - a collection C2 containing a binding &quot;b&quot; to R2 and mapped
to URI &quot;u2&quot; </tt></font>
<br><font size=2><tt>&gt; &nbsp; &nbsp;u1| <br>
&gt; &nbsp; &nbsp; &nbsp;C1 <br>
&gt; &nbsp; foo| &nbsp; &nbsp;|u2 <br>
&gt; &nbsp; &nbsp; C11 &nbsp; C2 <br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; |b <br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; R2 </tt></font>
<br><font size=2><tt>&gt; Now the following requests are issued (' marks
locked resources): <br>
&gt; - LOCK /u1 (write, exclusive, depth=infinity) <br>
&gt; &nbsp; --&gt; C11 is automatically added to the write-lock <br>
&gt; - PUT /u1/foo/a (passing locktoken) <br>
&gt; &nbsp; --&gt; creates R1 which is added to the write-lock (RFC2518,
Section 7.5) <br>
&gt; - BIND /u1/foo (b-&gt;/u2/b, passing locktoken) <br>
&gt; &nbsp; --&gt; R2 is added to the write-lock (RFC2518, Section 7.5)
</tt></font>
<br><font size=2><tt>&gt; &nbsp; &nbsp;u1| <br>
&gt; &nbsp; &nbsp; &nbsp;C1' <br>
&gt; &nbsp; foo| &nbsp; &nbsp;|u2 <br>
&gt; &nbsp; &nbsp; C11' &nbsp;C2 <br>
&gt; &nbsp; &nbsp; a| b\ |b <br>
&gt; &nbsp; &nbsp; &nbsp;R1' &nbsp;R2' </tt></font>
<br><font size=2><tt>&gt; - REBIND /u2 (a-&gt;/u1/foo/a, passing locktoken)
<br>
&gt; &nbsp; --&gt; R1 is removed from the write-lock (RFC2518, Section
7.7) </tt></font>
<br><font size=2><tt>&gt; &nbsp; &nbsp;u1| <br>
&gt; &nbsp; &nbsp; &nbsp;C1' <br>
&gt; &nbsp; foo| &nbsp; &nbsp;|u2 <br>
&gt; &nbsp; &nbsp; C11' &nbsp;C2 <br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp;b\ |b \a <br>
&gt; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; R2' R1 </tt></font>
<br><font size=2><tt>&gt; The described behavior for BIND and REBIND is
what I suppose it <br>
&gt; should be. Is it correct? </tt></font>
<br>
<br><font size=2><tt>Yes.</tt></font>
<br>
<br><font size=2><tt>&gt; BTW, what happens if, afterwards, the following
UNLOCK on R2 is issued: <br>
&gt; - UNLOCK /u1/foo/b (passing locktoken) <br>
&gt; &nbsp; --&gt; a) request is rejected, UNLOCK must be issued of C1
(/u1) <br>
&gt; &nbsp; or <br>
&gt; &nbsp; --&gt; b) all associated resources (C1, C11, R2) are unlocked
<br>
&gt; (RFC2518, Section 8.10.4) </tt></font>
<br>
<br><font size=2><tt>Several of us have strongly advocated (a), to avoid
a client mistakenly</tt></font>
<br><font size=2><tt>unlocking a whole tree of resources when they intended
to unlock a</tt></font>
<br><font size=2><tt>single resource. &nbsp;I don't believe this has been
resolved though.</tt></font>
<br>
<br><font size=2><tt>&gt; I suppose, that it is not possible to remove
single resources from <br>
&gt; the write-lock by means of UNLOCK, isn't it? </tt></font>
<br>
<br><font size=2><tt>That is correct, it is not possible.</tt></font>
<br>
<br><font size=2><tt>&gt; P.S.: <br>
&gt; At http://www.webdav.org/specs/ I found a link to http://ftp.ics.<br>
&gt; uci.edu/pub/ietf/webdav/collection/bind-issues.html, which contains
<br>
&gt; the following entry:</tt></font>
<br><font size=2><tt>&gt; &nbsp; &nbsp;&quot;ID: 41 <br>
&gt; &nbsp; &nbsp;Source: Reuter/Hunt <br>
&gt; &nbsp; &nbsp;Description: Specify how BIND interacts with a write
lock. <br>
&gt; &nbsp; &nbsp;Status: Closed <br>
&gt; &nbsp; &nbsp;Resolution: Declined <br>
&gt; &nbsp; &nbsp;Locking semantics is in too confused a state currently
to <br>
&gt; &nbsp; &nbsp;be able to make any reliable statements. Don't want to
hold <br>
&gt; &nbsp; &nbsp;up binding spec till lock settles down.&quot; </tt></font>
<br><font size=2><tt>&gt; Is that still prevailing? </tt></font>
<br>
<br><font size=2><tt>No, that is an obsolete document, and it (and any
links to it) should</tt></font>
<br><font size=2><tt>be removed. &nbsp;The current bind issues document
is:</tt></font>
<br>
<br><font size=2><tt>http://www.webdav.org/bind/bind-issues-list.htm</tt></font>
<br>
<br><font size=2><tt>Cheers,</tt></font>
<br><font size=2><tt>Geoff</tt></font>
<br>
--=_alternative 000D84D485256D95_=--



From w3c-dist-auth-request@w3.org  Tue Sep  2 15:42:43 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA01131
	for <webdav-archive@lists.ietf.org>; Tue, 2 Sep 2003 15:42:42 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id A6B43A0E8C; Tue,  2 Sep 2003 15:42:44 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 20CFEA0E8C
	for <w3c-dist-auth@frink.w3.org>; Tue,  2 Sep 2003 15:42:43 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 9248413343; Tue,  2 Sep 2003 15:40:55 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ucsc.edu (cats-mx1.ucsc.edu [128.114.129.36])
	by dr-nick.w3.org (Postfix) with ESMTP id 360D6133A9
	for <w3c-dist-auth@w3.org>; Tue,  2 Sep 2003 15:40:55 -0400 (EDT)
Received: from Tycho (dhcp-55-196.cse.ucsc.edu [128.114.55.196])
	by ucsc.edu (8.10.1/8.10.1) with SMTP id h82JdIf10134
	for <w3c-dist-auth@w3.org>; Tue, 2 Sep 2003 12:39:18 -0700 (PDT)
From: "Jim Whitehead" <ejw@cse.ucsc.edu>
To: "WebDAV" <w3c-dist-auth@w3.org>
Date: Tue, 2 Sep 2003 12:41:00 -0700
Message-ID: <AMEPKEBLDJJCCDEJHAMICEKFJAAA.ejw@cse.ucsc.edu>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0ABB_01C3714F.76F7EB20"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-UCSC-CATS-MailScanner: Found to be clean
Subject: FW: [Moderator Action] Re: WebDAV and WindowsXP
X-Archived-At: http://www.w3.org/mid/AMEPKEBLDJJCCDEJHAMICEKFJAAA.ejw@cse.ucsc.edu
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7842
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030902194244.A6B43A0E8C@frink.w3.org>
Resent-Date: Tue,  2 Sep 2003 15:42:44 -0400 (EDT)


This is a multi-part message in MIME format.

------=_NextPart_000_0ABB_01C3714F.76F7EB20
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Accidentally caught by the spam filter.

- Jim
-----Original Message-----
From: Chattey, Corey (LNG-BIN) [mailto:Corey.Chattey@lexisnexis.com]
Sent: Friday, August 22, 2003 11:41 PM
To: 'w3c-dist-auth@w3.org'
Subject: [Moderator Action] Re: WebDAV and WindowsXP


Hi...I'm having the same problem.  It's working fine under Web folders but
my Adobe applications which embrace WebDAV so well no longer function in
Windows XP.  Have you found a solution yet?



Any help would be much appreciated.



Corey Chattey
Electronic Production Associate
corey.chattey@lexisnexis.com
Toll Free: 800-323-9608, ext. 2628
Direct: 607-772-2628
http://www.lexisnexis.com

Matthew Bender
A Member of the LexisNexis Group

NALM



------=_NextPart_000_0ABB_01C3714F.76F7EB20
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns=3D"http://www.w3.org/TR/REC-html40" xmlns:o =3D=20
"urn:schemas-microsoft-com:office:office" xmlns:w =3D=20
"urn:schemas-microsoft-com:office:word" xmlns:st1 =3D=20
"urn:schemas-microsoft-com:office:smarttags"><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3DWord.Document name=3DProgId>
<META content=3D"MSHTML 6.00.2800.1170" name=3DGENERATOR>
<META content=3D"Microsoft Word 10" name=3DOriginator><LINK=20
href=3D"cid:filelist.xml@01C368B0.775BE5F0" =
rel=3DFile-List><o:SmartTagType=20
name=3D"PersonName"=20
namespaceuri=3D"urn:schemas-microsoft-com:office:smarttags"></o:SmartTagT=
ype><!--[if gte mso 9]><xml>
 <o:OfficeDocumentSettings>
  <o:DoNotRelyOnCSS/>
 </o:OfficeDocumentSettings>
</xml><![endif]--><!--[if gte mso 9]><xml>
 <w:WordDocument>
  <w:DocumentKind>DocumentEmail</w:DocumentKind>
  <w:EnvelopeVis/>
  <w:Compatibility>
   <w:BreakWrappedTables/>
   <w:SnapToGridInCell/>
   <w:WrapTextWithPunct/>
   <w:UseAsianBreakRules/>
  </w:Compatibility>
  <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel>
 </w:WordDocument>
</xml><![endif]--><!--[if !mso]>
<STYLE>st1\:* {
	BEHAVIOR: url(#default#ieooui)
}
</STYLE>
<![endif]-->
<STYLE>@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in =
1.25in; mso-header-margin: .5in; mso-footer-margin: .5in; =
mso-paper-source: 0; }
P.MsoNormal {
	FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"; =
mso-style-parent: ""; mso-pagination: widow-orphan; =
mso-fareast-font-family: "Times New Roman"
}
LI.MsoNormal {
	FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"; =
mso-style-parent: ""; mso-pagination: widow-orphan; =
mso-fareast-font-family: "Times New Roman"
}
DIV.MsoNormal {
	FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"; =
mso-style-parent: ""; mso-pagination: widow-orphan; =
mso-fareast-font-family: "Times New Roman"
}
A:link {
	COLOR: blue; TEXT-DECORATION: underline; text-underline: single
}
SPAN.MsoHyperlink {
	COLOR: blue; TEXT-DECORATION: underline; text-underline: single
}
A:visited {
	COLOR: purple; TEXT-DECORATION: underline; text-underline: single
}
SPAN.MsoHyperlinkFollowed {
	COLOR: purple; TEXT-DECORATION: underline; text-underline: single
}
SPAN.EmailStyle17 {
	COLOR: windowtext; FONT-FAMILY: Arial; mso-style-type: =
personal-compose; mso-style-noshow: yes; mso-ansi-font-size: 10.0pt; =
mso-bidi-font-size: 10.0pt; mso-ascii-font-family: Arial; =
mso-hansi-font-family: Arial; mso-bidi-font-family: Arial
}
DIV.Section1 {
	page: Section1
}
</STYLE>
<!--[if gte mso 10]>
<style>
 /* Style Definitions */=20
 table.MsoNormalTable
	{mso-style-name:"Table Normal";
	mso-tstyle-rowband-size:0;
	mso-tstyle-colband-size:0;
	mso-style-noshow:yes;
	mso-style-parent:"";
	mso-padding-alt:0in 5.4pt 0in 5.4pt;
	mso-para-margin:0in;
	mso-para-margin-bottom:.0001pt;
	mso-pagination:widow-orphan;
	font-size:10.0pt;
	font-family:"Times New Roman";}
</style>
<![endif]--></HEAD>
<BODY lang=3DEN-US style=3D"tab-interval: .5in" vLink=3Dpurple =
link=3Dblue>
<DIV><SPAN class=3D737212919-02092003><FONT face=3DArial color=3D#0000ff =

size=3D2>Accidentally caught by the spam filter.</FONT></SPAN></DIV>
<DIV><SPAN class=3D737212919-02092003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D737212919-02092003><FONT face=3DArial color=3D#0000ff =
size=3D2>-=20
Jim</FONT></SPAN></DIV>
<DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
size=3D2>-----Original Message-----<BR><B>From:</B> Chattey, Corey =
(LNG-BIN)=20
[mailto:Corey.Chattey@lexisnexis.com]<BR><B>Sent:</B> Friday, August 22, =
2003=20
11:41 PM<BR><B>To:</B> 'w3c-dist-auth@w3.org'<BR><B>Subject:</B> =
[Moderator=20
Action] Re: WebDAV and WindowsXP<BR><BR></FONT></DIV>
<DIV class=3DSection1>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Hi...I'm having the same=20
problem.<SPAN style=3D"mso-spacerun: yes">&nbsp; </SPAN>It's working =
fine under=20
Web folders but my Adobe applications which embrace WebDAV so well no =
longer=20
function in Windows XP. <SPAN style=3D"mso-spacerun: =
yes">&nbsp;</SPAN>Have you=20
found a solution yet?<o:p></o:p></SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"><o:p>&nbsp;</o:p></SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: Arial">Any help would be much=20
appreciated.<o:p></o:p></SPAN></FONT></P>
<P class=3DMsoNormal><FONT face=3DArial size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; FONT-FAMILY: =
Arial"><o:p>&nbsp;</o:p></SPAN></FONT></P>
<P class=3DMsoNormal><B><FONT face=3D"Times New Roman" size=3D2><SPAN=20
style=3D"FONT-WEIGHT: bold; FONT-SIZE: 10pt; mso-no-proof: yes">Corey=20
Chattey</SPAN></FONT></B><FONT size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; mso-no-proof: yes"><BR></SPAN></FONT><FONT =
size=3D1><SPAN=20
style=3D"FONT-SIZE: 7.5pt; mso-no-proof: yes">Electronic Production=20
Associate</SPAN></FONT><FONT size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; mso-no-proof: =
yes"><BR></SPAN></FONT><st1:PersonName><U><FONT=20
size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; mso-no-proof: =
yes">corey.chattey@lexisnexis.com</SPAN></FONT></U></st1:PersonName><FONT=
=20
size=3D2><SPAN style=3D"FONT-SIZE: 10pt; mso-no-proof: yes"><BR>Toll =
Free:=20
800-323-9608, ext. 2628<BR>Direct:=20
607-772-2628<BR>http://www.lexisnexis.com<BR><BR></SPAN></FONT><B><FONT=20
face=3DArial color=3Dred size=3D2><SPAN=20
style=3D"FONT-WEIGHT: bold; FONT-SIZE: 10pt; COLOR: red; FONT-FAMILY: =
Arial; mso-no-proof: yes">Matthew=20
Bender</SPAN></FONT></B><FONT face=3DArial color=3Dred size=3D2><SPAN=20
style=3D"FONT-SIZE: 10pt; COLOR: red; FONT-FAMILY: Arial; mso-no-proof: =
yes"><BR></SPAN></FONT><FONT=20
face=3DArial color=3Dred size=3D1><SPAN=20
style=3D"FONT-SIZE: 7.5pt; COLOR: red; FONT-FAMILY: Arial; mso-no-proof: =
yes">A=20
Member of the LexisNexis Group</SPAN></FONT><SPAN=20
style=3D"mso-no-proof: yes"><o:p></o:p></SPAN></P>
<P class=3DMsoNormal><FONT face=3DArial color=3Dred size=3D1><SPAN=20
style=3D"FONT-SIZE: 7.5pt; COLOR: red; FONT-FAMILY: Arial; mso-no-proof: =
yes">NALM</SPAN></FONT><o:p></o:p></P>
<P class=3DMsoNormal><FONT face=3D"Times New Roman" size=3D3><SPAN=20
style=3D"FONT-SIZE: =
12pt"><o:p>&nbsp;</o:p></SPAN></FONT></P></DIV></BODY></HTML>

------=_NextPart_000_0ABB_01C3714F.76F7EB20--



From w3c-dist-auth-request@w3.org  Thu Sep  4 12:57:06 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA07261
	for <webdav-archive@lists.ietf.org>; Thu, 4 Sep 2003 12:57:06 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id ECCCAA0AC7; Thu,  4 Sep 2003 12:56:26 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 6B690A0B80
	for <w3c-dist-auth@frink.w3.org>; Thu,  4 Sep 2003 12:56:13 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 2899413720; Thu,  4 Sep 2003 12:56:13 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from nebula.lyra.org (us-1.i3.intermud.org [198.144.203.194])
	by dr-nick.w3.org (Postfix) with ESMTP id CB03313751
	for <w3c-dist-auth@w3.org>; Thu,  4 Sep 2003 12:56:12 -0400 (EDT)
Received: from localhost.localdomain (nebula.lyra.org [127.0.0.1])
	by nebula.lyra.org (8.12.8/8.12.8) with ESMTP id h84H6NTq007452
	for <w3c-dist-auth@w3.org>; Thu, 4 Sep 2003 10:06:23 -0700
Date: Thu, 4 Sep 2003 10:06:23 -0700
Message-Id: <200309041706.h84H6NTq007452@nebula.lyra.org>
From: gstein@lyra.org
To: w3c-dist-auth@w3.org
Subject: received your email
X-Archived-At: http://www.w3.org/mid/200309041706.h84H6NTq007452@nebula.lyra.org
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7843
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030904165626.ECCCAA0AC7@frink.w3.org>
Resent-Date: Thu,  4 Sep 2003 12:56:26 -0400 (EDT)


Hi,

  [ Re: Thank you! ]

I have received your email, but it may take a while to respond. I'm really
sorry to have to hook up this auto-responder, as it is so impersonal.
However, I get a lot of email every day and find it very difficult to keep
up with it. Please be patient while I try to get to your message.

Please feel free to resend your message if you think I've missed it.

I'll always respond to personal email first. If your email is regarding some
of the software that I work on (if you have questions, comments,
suggestions, etc), then please resend it to the appropriate mailing list:

    mod_dav      <mailto:dav-dev@lyra.org>
    WebDAV       <mailto:w3c-dist-auth@w3.org>
    ViewCVS      <mailto:viewcvs@lyra.org>
    Subversion   <mailto:dev@subversion.tigris.org>
    edna         <mailto:edna@lyra.org>

Thank you!

Cheers,
-g

-- 
Greg Stein, http://www.lyra.org/



From w3c-dist-auth-request@w3.org  Thu Sep  4 18:42:30 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA28865
	for <webdav-archive@lists.ietf.org>; Thu, 4 Sep 2003 18:42:29 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 333C0A0808; Thu,  4 Sep 2003 18:42:34 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 4E392A0C97
	for <w3c-dist-auth@frink.w3.org>; Thu,  4 Sep 2003 18:42:17 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 1FE16138D8; Thu,  4 Sep 2003 18:42:17 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id DBB97138C8
	for <w3c-dist-auth@w3c.org>; Thu,  4 Sep 2003 18:42:16 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 19v2nw-0007uq-00
	for w3c-dist-auth@w3c.org; Thu, 04 Sep 2003 22:42:16 +0000
Received: from [192.168.1.151] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 19v2nv-0007ud-00
	for w3c-dist-auth@w3c.org; Thu, 04 Sep 2003 22:42:16 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: "Webdav WG" <w3c-dist-auth@w3c.org>
Date: Thu, 4 Sep 2003 15:43:10 -0700
Message-ID: <007701c37335$ef582ca0$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Old-X-Envelope-To: w3c-dist-auth@w3c.org
Subject: Notes from Vienna meeting
X-Archived-At: http://www.w3.org/mid/007701c37335$ef582ca0$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7844
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030904224234.333C0A0808@frink.w3.org>
Resent-Date: Thu,  4 Sep 2003 18:42:34 -0400 (EDT)
Content-Transfer-Encoding: quoted-printable



It seems I entirely forgot to post the meeting notes from the WG =
meeting.  The meeting mostly consisted of me reporting on progress made =
on the mailing lists.  I put together the notes myself as well as giving =
the status so I'd appreciate review for errors. =20

Lisa

---

WebDAV Working Group
Vienna IETF=20
July 2003


AGENDA
=E2=80=93	Interop plans =E2=80=93 5 min
=E2=80=93	Various draft status
=E2=80=93	ACL progress
=E2=80=93	RFC2518bis issues
=E2=80=93	Possible SIP needs

VARIOUS DRAFT STATUS

Ordering
=E2=80=93	Minor nits but approved by IESG
=E2=80=93	Last check on specific changes
Binding
=E2=80=93	Still requires significant explanation if not changes
Search
=E2=80=93	Minor progress


ACL PROGRESS

Addressed IESG review issues
Issue: too many possible semantics
-	Resolution: chose one=20
Issue: hard for clients to tell what ACL server will allow
=E2=80=93	Resolution: added acl-semantics info property
Issue: no clear privilege for DELETE method
=E2=80=93	Resolution: added =E2=80=98unbind=E2=80=99 privilege
Issue: allows insecure =E2=80=98Basic=E2=80=99 auth
=E2=80=93	Resolution: =E2=80=9CImplementation of the ACL spec requires=20
	that Basic authentication, if used, MUST only be=20
	supported over secure transport such as TLS.=E2=80=9D
Attempt to make mapping between methods and permissions more clear
The =E2=80=9Cwho am I=E2=80=9D request header, response header contains =
answer


RFC2518 BIS ISSUES

DTD usage
=E2=80=93	Do we include DTDs at all
=E2=80=93	Do we use content ANY or content a specific list of child =
elements
=E2=80=93	How do we show/enforce extensibility?
=E2=80=93	How do we show namespace usage (e.g. on attributes)?
=E2=80=93	ELEMENT foo | ns (bar, baz?, ANY)
207 response to DELETE failures
=E2=80=93	Again=E2=80=A6
=E2=80=93	Keep or toss=09
Stronger requirement for ETag support
=E2=80=93	Still not MUST




From w3c-dist-auth-request@w3.org  Thu Sep  4 19:55:57 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03158
	for <webdav-archive@lists.ietf.org>; Thu, 4 Sep 2003 19:55:55 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id CC000A05C6; Thu,  4 Sep 2003 19:55:59 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 9D86CA05C6
	for <w3c-dist-auth@frink.w3.org>; Thu,  4 Sep 2003 19:55:38 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 5BC5A13871; Thu,  4 Sep 2003 19:55:38 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ucsc.edu (cats-mx1.ucsc.edu [128.114.129.36])
	by dr-nick.w3.org (Postfix) with ESMTP id 5879C13973
	for <w3c-dist-auth@w3.org>; Thu,  4 Sep 2003 19:55:05 -0400 (EDT)
Received: from Tycho (dhcp-55-196.cse.ucsc.edu [128.114.55.196])
	by ucsc.edu (8.10.1/8.10.1) with SMTP id h84Nr1f26184;
	Thu, 4 Sep 2003 16:53:01 -0700 (PDT)
From: "Jim Whitehead" <ejw@cse.ucsc.edu>
To: <interop@webdav.org>, "WebDAV" <w3c-dist-auth@w3.org>
Date: Thu, 4 Sep 2003 16:54:44 -0700
Message-ID: <AMEPKEBLDJJCCDEJHAMICEKPJBAA.ejw@cse.ucsc.edu>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-UCSC-CATS-MailScanner: Found to be clean
Subject: Reminder: WebDAV Interop. Event, Sept. 15-16
X-Archived-At: http://www.w3.org/mid/AMEPKEBLDJJCCDEJHAMICEKPJBAA.ejw@cse.ucsc.edu
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7845
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030904235559.CC000A05C6@frink.w3.org>
Resent-Date: Thu,  4 Sep 2003 19:55:59 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Just a quick reminder that we're holding a face-to-face interoperability
testing event September 15-16, 2003, in the Baskin Engineering Building at
UC Santa Cruz, in Santa Cruz, California.

Right now we have confirmed attendees from Oracle, Xythos, Microsoft,
Software AG, Sun, Sambar, Apple, NASA Ames, and UCSC. There's still room for
additional participants, and we encourage testing of both development and
shipping code.

More details can be found here:

http://www.webdav.org/other/interop03/

If you're planning on attending, and haven't yet registered, please send me
an email, so we get an accurate count so we have enough food and network
taps.

- Jim Whitehead
ejw@cs.ucsc.edu



From w3c-dist-auth-request@w3.org  Thu Sep  4 19:59:40 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA03372
	for <webdav-archive@lists.ietf.org>; Thu, 4 Sep 2003 19:59:40 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 7C625A0C1E; Thu,  4 Sep 2003 19:59:43 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 5AAB0A0BD2
	for <w3c-dist-auth@frink.w3.org>; Thu,  4 Sep 2003 19:59:24 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 0DF28136F5; Thu,  4 Sep 2003 19:59:24 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ucsc.edu (cats-mx1.ucsc.edu [128.114.129.36])
	by dr-nick.w3.org (Postfix) with ESMTP id DCFF5137EE
	for <w3c-dist-auth@w3.org>; Thu,  4 Sep 2003 19:59:18 -0400 (EDT)
Received: from Tycho (dhcp-55-196.cse.ucsc.edu [128.114.55.196])
	by ucsc.edu (8.10.1/8.10.1) with SMTP id h84Nv6f27882
	for <w3c-dist-auth@w3.org>; Thu, 4 Sep 2003 16:57:07 -0700 (PDT)
From: "Jim Whitehead" <ejw@cse.ucsc.edu>
To: "WebDAV" <w3c-dist-auth@w3.org>
Date: Thu, 4 Sep 2003 16:58:49 -0700
Message-ID: <AMEPKEBLDJJCCDEJHAMIMEKPJBAA.ejw@cse.ucsc.edu>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0352_01C37305.CFFCFC80"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-UCSC-CATS-MailScanner: Found to be clean
Subject: FW: Partial Property Data Retrieval???
X-Archived-At: http://www.w3.org/mid/AMEPKEBLDJJCCDEJHAMIMEKPJBAA.ejw@cse.ucsc.edu
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7846
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030904235943.7C625A0C1E@frink.w3.org>
Resent-Date: Thu,  4 Sep 2003 19:59:43 -0400 (EDT)


This is a multi-part message in MIME format.

------=_NextPart_000_0352_01C37305.CFFCFC80
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Accidentally caught by the spam filter. I've added Frank's email to the
accept2 list.

- Jim
-----Original Message-----
From: Frank Judge [mailto:Frank.Judge@corp.palm.com]
Sent: Thursday, September 04, 2003 4:37 PM
To: w3c-dist-auth@w3.org
Subject: [Moderator Action] Partial Property Data Retrieval???


Hi,

I've read over the specifications and want to know if I'm missing something
or if you considered a capability.  For properties in a schema that have
large amounts of data, does WebDAV specify a means to retrieve only portions
of that data?  For example, if you have a document object that has only a
text property containing all the document data, you may only want the first
100K of a 10 megabyte document.  For email the POP and IMAP protocols allow
subsets of the message data to be retrieved ( POP TOP command for
instance ).  Have you thought of allowing retrieval of only a subset of
property data, and if you have could you point me to the reference that
shows how?

Thanks,

Frank Judge
Palm Inc.
frank.judge@corp.palm.com

------=_NextPart_000_0352_01C37305.CFFCFC80
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1170" name=3DGENERATOR></HEAD>
<BODY>
<DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN=20
class=3D311285523-04092003>Accidentally caught by the spam filter. I've =
added=20
Frank's email to the accept2 list.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN=20
class=3D311285523-04092003></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN =
class=3D311285523-04092003>-=20
Jim</SPAN></FONT></DIV>
<DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
size=3D2>-----Original Message-----<BR><B>From:</B> Frank Judge=20
[mailto:Frank.Judge@corp.palm.com]<BR><B>Sent:</B> Thursday, September =
04, 2003=20
4:37 PM<BR><B>To:</B> w3c-dist-auth@w3.org<BR><B>Subject:</B> [Moderator =
Action]=20
Partial Property Data Retrieval???<BR><BR></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D937122823-04092003>Hi,</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D937122823-04092003></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D937122823-04092003>I've =
read over the=20
specifications and want to know if I'm missing something or if you =
considered a=20
capability.&nbsp; For properties in a schema that have large amounts of =
data,=20
does WebDAV specify a means to retrieve only portions of that =
data?&nbsp; For=20
example, if you have a document object&nbsp;that has&nbsp;only =
a&nbsp;text=20
property containing all the document&nbsp;data, you may only want the =
first 100K=20
of a&nbsp;10 megabyte document.&nbsp; For email the POP and IMAP =
protocols allow=20
subsets of the message data to be retrieved ( POP TOP command for =
instance=20
).&nbsp; Have you thought of allowing retrieval of only a subset of =
property=20
data, and if you have could you point me to the reference that shows=20
how?</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D937122823-04092003></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D937122823-04092003>Thanks,</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D937122823-04092003></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D937122823-04092003>Frank=20
Judge</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN class=3D937122823-04092003>Palm=20
Inc.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial size=3D2><SPAN=20
class=3D937122823-04092003>frank.judge@corp.palm.com</SPAN></FONT></DIV><=
/BODY></HTML>

------=_NextPart_000_0352_01C37305.CFFCFC80--



From w3c-dist-auth-request@w3.org  Fri Sep  5 06:55:35 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA13826
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 06:55:25 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id C2B24A0D54; Fri,  5 Sep 2003 06:55:20 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id B5B56A0D54
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 06:55:01 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 72D251383B; Fri,  5 Sep 2003 06:55:01 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.gmx.net (mail.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 085B813596
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 06:55:01 -0400 (EDT)
Received: (qmail 4836 invoked by uid 65534); 5 Sep 2003 10:55:00 -0000
Received: from p3EE24718.dip.t-dialin.net (HELO lisa) (62.226.71.24)
  by mail.gmx.net (mp005) with SMTP; 05 Sep 2003 12:55:00 +0200
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Horst Liermann" <horst.liermann@ixos.de>,
        "'Julian Reschke'" <julian.reschke@gmx.de>,
        "'Webdav WG'" <w3c-dist-auth@w3c.org>
Date: Fri, 5 Sep 2003 12:54:50 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCEEPBIFAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
In-reply-to: <077097E85A6BD3119E910800062786A905121EBA@muc-mail5.ixos.de>
Subject: RE: new issue: DAV:displayname
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCEEPBIFAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7847
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905105520.C2B24A0D54@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 06:55:20 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Here's some more info on DAV:displayname vs Microsoft clients:

There are at least two different types of webfolder clients: those shipping
with W2K and O2K (DLL version 8.*) completely ignore DAV:displayname. Those
shipping with Windows XP, Office XP and Sharepoint do "support"
DAV:displayname, but have multiple bugs in doing so:

<http://greenbytes.de/tech/webdav/webfolder-client-list.html#issue-displayed
-href>:

"The URI displayed in the "internet adress" column is constructed from the
base URI of the collection and the resource's DAV:displayname property (when
present). This is wrong - the column should display the DAV:href returned in
the PROPFIND response body."

<http://greenbytes.de/tech/webdav/webfolder-client-list.html#issue-displayna
me-1>

"The Webfolder client displays the DAV:displayname only if it doesn't
contain some characters that happen to be reserved in filenames (such as
"/"). However, the displayname is just a textual description, so it should
be displayable no matter what kind of text it contains (basically this is
caused by the Webfolder mistaking the displayname to be some kind of
replacement resource name)."

<http://greenbytes.de/tech/webdav/webfolder-client-list.html#issue-displayna
me-2>

"If the client decides to use the DAV:displayname instead of the last path
segment for display, it seems to internally confuse both. A rename operation
on a resource where the displayname and the last path segment differ fails
because the client submits the MOVE request to a broken request URI
(collection href and displayname concatenated)."

If you are aware of more issues, please report them (so I'll can put them
into the issues list). Also it would be nice to get some feedback about
which issue appears in which client (obviously I can't test them all :-)

Regards, Julian


--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Horst Liermann
> Sent: Monday, August 18, 2003 3:53 PM
> To: 'Julian Reschke'; 'Webdav WG'
> Subject: RE: new issue: DAV:displayname
>
>
>
> Hi,
>
> I have installed "MS Sharepoint" and I tested the behavior of Sharepoint.
> Sharepoint is a basic WebDAV implementation. They have something like
> versioning, but it's not DeltaV.
>
> As far as I understand MS-Sharepoint, the behavior is:
>
> 	There is a URL "segment name" for the name of the resource.
> 	There is a DAV:displayname for the "title" of the resource.
>
> DAV:displayname normaly is not the same as the "segment name". So
> DAV:displayname is a "dead" property
> It's also possible NOT setting the property DAV:displayname.
>
> Behavior is like 2).
>
>
> Horst
>
>
>
>
> -----Original Message-----
> From: Julian Reschke [mailto:julian.reschke@gmx.de]
> Sent: Sunday, August 17, 2003 1:03 PM
> To: 'Webdav WG'
> Subject: new issue: DAV:displayname
>
>
>
> Hi,
>
> looking at our recent discussion, I feel that we clearly have a
> problem with
> the usage of DAV:displayname.
>
> The current situation seems to be:
>
> 1) Some servers implement DAV:displayname as protected live property that
> just reflects the last name segment of the request URI (Microsoft IIS)
>
> 2) Other servers implement DAV:displayname as dead property that
> by default
> is not set until it get's explicitly set by a client (Apache moddav)
>
>
> We are currently discussing whether 1) is ok. My position is that it's
> clearly not, as
>
> - the value of the last path segment is not "a description of the resource
> that is suitable for presentation to a user",
>
> - replicating something that's already available from the <href>
> element of
> the PROPFIND response into a property just has no benefit at all,
>
> - clients demonstratibly can cope with absent DAV:displayname values (as
> they all interoperate with Apache moddav today) and finally
>
> - the concept of a property that varies with the request URI is deeply
> incompatible with the concept of multiple bindings to resources.
>
>
> So my preference would be just to state that DAV:displayname SHOULD NOT be
> used to replicate the information from the last path segment.
>
> Another alternative would be to *deprecate* DAV:displayname and
> to define a
> new property with more precisely defined semantics, such as
> DAV:description.
>
>
> Note that this in fact *is* a interoperability issues, as we are getting
> lots of complaints from users not being able to set display names on some
> remote WebDAV servers mounted into the SAP Enterprise Portal.
>
>
> Julian
>
> --
> <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
>



From w3c-dist-auth-request@w3.org  Fri Sep  5 07:17:57 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA14806
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 07:17:57 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id AEEFDA0D3A; Fri,  5 Sep 2003 07:18:00 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 09256A0B7B
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 07:17:42 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 95D5B13A4C; Fri,  5 Sep 2003 07:17:41 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.gmx.net (mail.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 2C08813A3B
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 07:17:41 -0400 (EDT)
Received: (qmail 29709 invoked by uid 65534); 5 Sep 2003 11:17:40 -0000
Received: from p3EE24718.dip.t-dialin.net (HELO lisa) (62.226.71.24)
  by mail.gmx.net (mp012) with SMTP; 05 Sep 2003 13:17:40 +0200
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "'Webdav WG'" <w3c-dist-auth@w3c.org>
Date: Fri, 5 Sep 2003 13:17:30 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCKEPCIFAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
In-reply-to: <077097E85A6BD3119E910800062786A905121EBA@muc-mail5.ixos.de>
Subject: call for participation: roundtripping of WebDAV properties in filesystems
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCKEPCIFAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7848
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905111800.AEEFDA0D3A@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 07:18:00 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Hi,

I got interested in this issue by some comments in Jim's article "The WebDAV
property design" [1] and discussion on the Subversion mailing list about
NTFS features.

The problem(s):

(a) resources copied to a local file system generally loose their WebDAV
property information, thus they won't round-trip when the resource is PUT
back to a WebDAV server

(b) WebDAV clients mapping servers to filesystems generally can't map the
properties to something a filesystem-based client can take advantage of.

The issues:

(1) Where to store the property information. The only portable solution
involves exposing a second file somewhere else in the namespace (such as by
appending a particular extension). In general, this is ugly due to possible
name collisions, and the fact that the properties will not automatically
move with the base file. Filesystems that offer multiple data streams or
data forks may do better (see below for some information about NTFS data
streams).

(2) Which format to use.


I think there's some hope in getting interoperability if we can get the
client developers (such as MS, Xythos, Apply, davfs Linux developers) to get
together (such as during the Interop event).


Possible solutions:

(1) This problem is hard in general but almost trivial for WIN32 scenarios.
NTFS supports multiple data streams that can be accessed with generic file
syntax (see [2]). All we'd need to do is to agree on a well-known name for
the stream (such as ":dav-properties").

(2) Let's just use the XML serialization of the DAV:prop element from a
PROPFIND/allprop response body.


Proof-of-concept:

Below is a script for Windows Scripting Host that GETs/PROPFINDs a resource
and stores the properties in the named data stream ":dav-properties". You
can see the properties by just opening the data stream like a regular file,
such as

	cat filename:dav-properties

Usage:

cscript davget.js URL destination-file user password


--
// davget.js
// GET a file from an HTTP server, storing it's properties in a NTFS data
stream
// params: URL localfile user password

var fso = new ActiveXObject("Scripting.FileSystemObject");
var http = new ActiveXObject("MSXML2.ServerXMLHTTP.3.0");
var stream = new ActiveXObject("ADODB.Stream");

var url = WScript.Arguments(0);


// PROPFIND

http.open("PROPFIND", url, false, WScript.Arguments(2),
WScript.Arguments(3));
http.setRequestHeader("Depth", "0");
http.send("<propfind xmlns='DAV:'><allprop/></propfind>");

if (http.status != 207) {
  WScript.Echo("unexpected status from PROPFIND: " + http.status);
  WScript.Quit(1);
}

var props = new ActiveXObject("MSXML2.DOMDocument");

http.responseXML.setProperty("SelectionLanguage", "XPath");
http.responseXML.setProperty("SelectionNamespaces", "xmlns:D='DAV:'");

props.appendChild(

http.responseXML.selectSingleNode("/D:multistatus/D:response/D:propstat[cont
ains(D:status,'200')]/D:prop"));

http.open("GET", url, false, WScript.Arguments(2), WScript.Arguments(3));
http.send();

if (http.status != 200) {
  WScript.Echo("unexpected status from GET: " + http.status);
  WScript.Quit(1);
}

stream.open();
stream.Type = 1;
try {
  if (http.responseText.length > 0) {
    stream.Write(http.responseBody);
  }
}
catch (e) {
  WScript.Echo("empty content? " + e);
}

stream.SaveToFile(WScript.Arguments(1), 2);
stream.close();

stream.open();
stream.Type = 1;
props.save(stream);
stream.SaveToFile(WScript.Arguments(1) + ":dav-props", 2);
stream.close();
--

Feedback appreciated,

Julian





[1] <http://www.cs.ucsc.edu/~ejw/papers/spe-whitehead.pdf>
[2] <http://www.sysinternals.com/ntw2k/source/misc.shtml#Streams>

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760



From w3c-dist-auth-request@w3.org  Fri Sep  5 10:19:26 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA25822
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 10:19:26 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 28BE1A0E28; Fri,  5 Sep 2003 10:19:31 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id DBF64A0E28
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 10:19:11 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 70A5113B23; Fri,  5 Sep 2003 10:19:11 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from e2.ny.us.ibm.com (e2.ny.us.ibm.com [32.97.182.102])
	by dr-nick.w3.org (Postfix) with ESMTP id 54C1213B09
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 10:19:11 -0400 (EDT)
Received: from northrelay02.pok.ibm.com (northrelay02.pok.ibm.com [9.56.224.150])
	by e2.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h85EJBGh402716
	for <w3c-dist-auth@w3c.org>; Fri, 5 Sep 2003 10:19:11 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay02.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h85EJ9LA064454
	for <w3c-dist-auth@w3c.org>; Fri, 5 Sep 2003 10:19:10 -0400
In-Reply-To: <007701c37335$ef582ca0$f8cb90c6@lisalap>
To: "Webdav WG" <w3c-dist-auth@w3c.org>
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
Message-ID: <OFC24B4E96.DE4EED36-ON85256D98.004E05F3-85256D98.004EA47F@us.ibm.com>
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Date: Fri, 5 Sep 2003 10:18:59 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/05/2003 10:19:10,
	Serialize complete at 09/05/2003 10:19:10
Content-Type: multipart/alternative; boundary="=_alternative 004EA47A85256D98_="
Subject: Re: Notes from Vienna meeting
X-Archived-At: http://www.w3.org/mid/OFC24B4E96.DE4EED36-ON85256D98.004E05F3-85256D98.004EA47F@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7849
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905141931.28BE1A0E28@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 10:19:31 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 004EA47A85256D98_=
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: base64

VGhlcmUgaXMgb25seSBvbmUgb3BlbiBpc3N1ZSBpbiB0aGUgYmluZGluZyBkcmFmdDoNCjxodHRw
Oi8vd3d3LndlYmRhdi5vcmcvYmluZC9iaW5kLWlzc3Vlcy1saXN0Lmh0bT4gNS4xX0xPT1BfU1RB
VFVTLg0KDQpJZiBzb21lYm9keSBiZWxpZXZlcyB0aGF0IHNvbWV0aGluZyBpbiB0aGUgZHJhZnQg
c3RpbGwgcmVxdWlyZXMNCnNpZ25pZmljYW50IGV4cGxhbmF0aW9uIChvciBjaGFuZ2VzKSwgdGhl
eSBuZWVkIHRvIGlkZW50aWZ5IGl0DQpzbyB3ZSBjYW4gYWRkIGl0IHRvIHRoZSBiaW5kLWlzc3Vl
cy1saXN0LiAgSWYgbm90LCB0aGUgc3RhdHVzIA0KZm9yIHRoZSBiaW5kaW5nIHByb3RvY29sIHNo
b3VsZCBiZSB1cGRhdGVkIHRvIHN0YXRlICJvbmx5IG9uZQ0KaXNzdWUgcmVtYWluaW5nIHRvIGJl
IHJlc29sdmVkIGZvciBsYXN0IGNhbGwiLg0KDQpDaGVlcnMsDQpHZW9mZg0KDQoNCkxpc2Egd3Jv
dGUgb24gMDkvMDQvMjAwMyAwNjo0MzoxMCBQTToNCg0KPiBXZWJEQVYgV29ya2luZyBHcm91cA0K
PiBWaWVubmEgSUVURiANCj4gSnVseSAyMDAzDQo+IA0KPiBWQVJJT1VTIERSQUZUIFNUQVRVUw0K
Li4uDQo+IEJpbmRpbmcNCj4g4oCTICAgU3RpbGwgcmVxdWlyZXMgc2lnbmlmaWNhbnQgZXhwbGFu
YXRpb24gaWYgbm90IGNoYW5nZXMNCg0K
--=_alternative 004EA47A85256D98_=
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: base64

DQo8YnI+PGZvbnQgc2l6ZT0yPjx0dD5UaGVyZSBpcyBvbmx5IG9uZSBvcGVuIGlzc3VlIGluIHRo
ZSBiaW5kaW5nIGRyYWZ0OjwvdHQ+PC9mb250Pg0KPGJyPjxmb250IHNpemU9Mj48dHQ+Jmx0O2h0
dHA6Ly93d3cud2ViZGF2Lm9yZy9iaW5kL2JpbmQtaXNzdWVzLWxpc3QuaHRtJmd0Ow0KNS4xX0xP
T1BfU1RBVFVTLjwvdHQ+PC9mb250Pg0KPGJyPg0KPGJyPjxmb250IHNpemU9Mj48dHQ+SWYgc29t
ZWJvZHkgYmVsaWV2ZXMgdGhhdCBzb21ldGhpbmcgaW4gdGhlIGRyYWZ0IHN0aWxsDQpyZXF1aXJl
czwvdHQ+PC9mb250Pg0KPGJyPjxmb250IHNpemU9Mj48dHQ+c2lnbmlmaWNhbnQgZXhwbGFuYXRp
b24gKG9yIGNoYW5nZXMpLCB0aGV5IG5lZWQgdG8NCmlkZW50aWZ5IGl0PC90dD48L2ZvbnQ+DQo8
YnI+PGZvbnQgc2l6ZT0yPjx0dD5zbyB3ZSBjYW4gYWRkIGl0IHRvIHRoZSBiaW5kLWlzc3Vlcy1s
aXN0LiAmbmJzcDtJZg0Kbm90LCB0aGUgc3RhdHVzIDwvdHQ+PC9mb250Pg0KPGJyPjxmb250IHNp
emU9Mj48dHQ+Zm9yIHRoZSBiaW5kaW5nIHByb3RvY29sIHNob3VsZCBiZSB1cGRhdGVkIHRvIHN0
YXRlDQomcXVvdDtvbmx5IG9uZTwvdHQ+PC9mb250Pg0KPGJyPjxmb250IHNpemU9Mj48dHQ+aXNz
dWUgcmVtYWluaW5nIHRvIGJlIHJlc29sdmVkIGZvciBsYXN0IGNhbGwmcXVvdDsuPC90dD48L2Zv
bnQ+DQo8YnI+DQo8YnI+PGZvbnQgc2l6ZT0yPjx0dD5DaGVlcnMsPC90dD48L2ZvbnQ+DQo8YnI+
PGZvbnQgc2l6ZT0yPjx0dD5HZW9mZjwvdHQ+PC9mb250Pg0KPGJyPg0KPGJyPg0KPGJyPjxmb250
IHNpemU9Mj48dHQ+TGlzYSB3cm90ZSBvbiAwOS8wNC8yMDAzIDA2OjQzOjEwIFBNOjxicj4NCjxi
cj4NCiZndDsgV2ViREFWIFdvcmtpbmcgR3JvdXA8YnI+DQomZ3Q7IFZpZW5uYSBJRVRGIDxicj4N
CiZndDsgSnVseSAyMDAzPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IFZBUklPVVMgRFJBRlQgU1RBVFVT
PGJyPg0KLi4uPGJyPg0KJmd0OyBCaW5kaW5nPGJyPg0KJmd0OyDigJMgJm5ic3A7IFN0aWxsIHJl
cXVpcmVzIHNpZ25pZmljYW50IGV4cGxhbmF0aW9uIGlmIG5vdCBjaGFuZ2VzPGJyPg0KPC90dD48
L2ZvbnQ+DQo=
--=_alternative 004EA47A85256D98_=--



From w3c-dist-auth-request@w3.org  Fri Sep  5 12:21:47 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA03781
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 12:21:47 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 9D999A0F67; Fri,  5 Sep 2003 12:19:37 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id E493EA0F54
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 12:19:13 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 6F51B13B5E; Fri,  5 Sep 2003 12:19:13 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from server8a.software-ag.de (server8a.software-ag.de [193.26.193.47])
	by dr-nick.w3.org (Postfix) with ESMTP id 956A8134ED
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 12:19:12 -0400 (EDT)
Received: from daehub01.software-ag.de by server8a.software-ag.de; (8.11.6/8.9.3)
	id h85GJA323176; Fri, 5 Sep 2003 18:19:10 +0200
Received: by daehub01.software-ag.de with Internet Mail Service (5.5.2653.19)
	id <RTLM9QFY>; Fri, 5 Sep 2003 18:19:10 +0200
Message-ID: <DFF2AC9E3583D511A21F0008C7E6210605C4807D@daemsg02.software-ag.de>
From: "Nevermann, Dr., Peter" <Peter.Nevermann@softwareag.com>
To: "'w3c-dist-auth@w3c.org'" <w3c-dist-auth@w3c.org>
Date: Fri, 5 Sep 2003 18:19:09 +0200 
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C373C9.6F83DF80"
Subject: DAV:getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/DFF2AC9E3583D511A21F0008C7E6210605C4807D@daemsg02.software-ag.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7850
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905161937.9D999A0F67@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 12:19:37 -0400 (EDT)


This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C373C9.6F83DF80
Content-Type: text/plain;
	charset="iso-8859-1"

AFAIK, according to RFC2518, Section 13.7, the DAV:getlastmodified property
is not required to be defined for collections, but a server MAY define it.
Is that correct?

Then, probably the bindings of the collection are to be considered part of
the collection's state and it would make sense to set DAV:getlastmodified
whenever the bindings change:
- BIND, UNBIND (the coll identified by the req-URI)
- REBIND (the coll identified by the req-URI AND the 2nd involved coll)
- PUT returning 201 (the containing collection)
- MKCOL (the containing collection)
- DELETE (the containing collection)
- LOCK creating a lock-null resource (the containing collection)
- VERSION-CONTROL on existing version (the containing workspace)

Sorry for such a basic question, but I didn't find it in the specs.

Regards,
Peter

------_=_NextPart_001_01C373C9.6F83DF80
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2653.12">
<TITLE>DAV:getlastmodified of collections</TITLE>
</HEAD>
<BODY>

<P><FONT SIZE=3D2>AFAIK, according to RFC2518, Section 13.7, the =
DAV:getlastmodified property is not required to be defined for =
collections, but a server MAY define it. Is that correct?</FONT></P>

<P><FONT SIZE=3D2>Then, probably the bindings of the collection are to =
be considered part of the collection's state and it would make sense to =
set DAV:getlastmodified whenever the bindings change:</FONT></P>

<P><FONT SIZE=3D2>- BIND, UNBIND (the coll identified by the =
req-URI)</FONT>
<BR><FONT SIZE=3D2>- REBIND (the coll identified by the req-URI AND the =
2nd involved coll)</FONT>
<BR><FONT SIZE=3D2>- PUT returning 201 (the containing =
collection)</FONT>
<BR><FONT SIZE=3D2>- MKCOL (the containing collection)</FONT>
<BR><FONT SIZE=3D2>- DELETE (the containing collection)</FONT>
<BR><FONT SIZE=3D2>- LOCK creating a lock-null resource (the containing =
collection)</FONT>
<BR><FONT SIZE=3D2>- VERSION-CONTROL on existing version (the =
containing workspace)</FONT>
</P>

<P><FONT SIZE=3D2>Sorry for such a basic question, but I didn't find it =
in the specs.</FONT>
</P>

<P><FONT SIZE=3D2>Regards,</FONT>
<BR><FONT SIZE=3D2>Peter</FONT>
</P>

</BODY>
</HTML>
------_=_NextPart_001_01C373C9.6F83DF80--



From w3c-dist-auth-request@w3.org  Fri Sep  5 14:01:50 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09474
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 14:01:49 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id C11B3A0E90; Fri,  5 Sep 2003 14:01:52 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 9F2ACA0E90
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 14:01:48 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 079EF13925; Fri,  5 Sep 2003 14:01:48 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from gate.arc.nasa.gov (gate.arc.nasa.gov [128.102.102.51])
	by dr-nick.w3.org (Postfix) with ESMTP id A2F4113590
	for <w3c-dist-auth@w3.org>; Fri,  5 Sep 2003 14:01:47 -0400 (EDT)
Received: from nasa.gov (moonstone.aen.nasa.gov [198.123.13.108])
	by gate.arc.nasa.gov ( -- Info omitted by ASANI Solutions, LLC.) with ESMTP id h85I1kW16694;
	Fri, 5 Sep 2003 11:01:46 -0700 (PDT)
Message-ID: <3F58CFA9.70201@nasa.gov>
Date: Fri, 05 Sep 2003 11:02:17 -0700
From: Chris Knight <Christopher.D.Knight@nasa.gov>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: frank.judge@corp.palm.com
Cc: WebDAV <w3c-dist-auth@w3.org>
References: <AMEPKEBLDJJCCDEJHAMIMEKPJBAA.ejw@cse.ucsc.edu>
In-Reply-To: <AMEPKEBLDJJCCDEJHAMIMEKPJBAA.ejw@cse.ucsc.edu>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: FW: Partial Property Data Retrieval???
X-Archived-At: http://www.w3.org/mid/3F58CFA9.70201@nasa.gov
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7851
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905180152.C11B3A0E90@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 14:01:52 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Frank Judge wrote:

>I've read over the specifications and want to know if I'm missing
>something or if you considered a capability.  For properties in a schema
>that have large amounts of data, does WebDAV specify a means to retrieve
>only portions of that data?  For example, if you have a document object
>that has only a text property containing all the document data, you may
>only want the first 100K of a 10 megabyte document.  For email the POP
>and IMAP protocols allow subsets of the message data to be retrieved (
>POP TOP command for instance ).  Have you thought of allowing retrieval
>of only a subset of property data, and if you have could you point me to
>the reference that shows how?
>  
>

Alas, WebDAV does not allow for retrieval of part of a property. It 
would be very interesting and useful for large structured properties, as 
you've said. Probably would have to support 
XPath...http://www.w3c.org/TR/xpath



From w3c-dist-auth-request@w3.org  Fri Sep  5 14:11:57 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA09997
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 14:11:57 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id E58BEA0F49; Fri,  5 Sep 2003 14:11:44 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 41257A0F49
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 14:11:37 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id D515813B8F; Fri,  5 Sep 2003 14:11:36 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from e2.ny.us.ibm.com (e2.ny.us.ibm.com [32.97.182.102])
	by dr-nick.w3.org (Postfix) with ESMTP id B3AB513B86
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 14:11:36 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e2.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h85IBaGh425958
	for <w3c-dist-auth@w3c.org>; Fri, 5 Sep 2003 14:11:36 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h85IBYcU046346
	for <w3c-dist-auth@w3c.org>; Fri, 5 Sep 2003 14:11:35 -0400
In-Reply-To: <DFF2AC9E3583D511A21F0008C7E6210605C4807D@daemsg02.software-ag.de>
To: "'w3c-dist-auth@w3c.org'" <w3c-dist-auth@w3c.org>
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
Message-ID: <OF592A9E1C.46FE6A2C-ON85256D98.00635A43-85256D98.0063F0A8@us.ibm.com>
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Date: Fri, 5 Sep 2003 14:11:35 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/05/2003 14:11:35,
	Serialize complete at 09/05/2003 14:11:35
Content-Type: text/plain; charset="US-ASCII"
Subject: Re: DAV:getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/OF592A9E1C.46FE6A2C-ON85256D98.00635A43-85256D98.0063F0A8@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7852
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905181144.E58BEA0F49@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 14:11:44 -0400 (EDT)


Also, MOVE (on the collections containing the source and destination).
Also, COPY (on the collections containing any new resources created by the 
COPY).
One correction: VERSION-CONTROL affects the state of the collection
containing the resource being created, not on the containing workspace
(unless the workspace is the collection containing the resource).

I agree that this would be worth adding to 2518bis, i.e. saying that
"If a server supports DAV:getlastmodified for a collection, it must be
updated any time an internal member (2518's name for a binding) is
added or removed from a collection."

Lisa (or whoever is maintaining the 2518bis issues list):
Can this be added to the 2518bis issues list?

Cheers,
Geoff

Peter wrote on 09/05/2003 12:19:09 PM:

> AFAIK, according to RFC2518, Section 13.7, the DAV:getlastmodified 
> property is not required to be defined for collections, but a server
> MAY define it. Is that correct?
> Then, probably the bindings of the collection are to be considered 
> part of the collection's state and it would make sense to set DAV:
> getlastmodified whenever the bindings change:
> - BIND, UNBIND (the coll identified by the req-URI) 
> - REBIND (the coll identified by the req-URI AND the 2nd involved coll) 
> - PUT returning 201 (the containing collection) 
> - MKCOL (the containing collection) 
> - DELETE (the containing collection) 
> - LOCK creating a lock-null resource (the containing collection) 
> - VERSION-CONTROL on existing version (the containing workspace) 
> Sorry for such a basic question, but I didn't find it in the specs. 
> Regards, 
> Peter 



From w3c-dist-auth-request@w3.org  Fri Sep  5 14:22:26 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA10721
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 14:22:25 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 29ECFA05D7; Fri,  5 Sep 2003 14:22:30 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 68DB5A0976
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 14:22:05 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id EB8A913A48; Fri,  5 Sep 2003 14:22:04 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id D03DA13925
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 14:22:04 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 19vLDg-0005je-00; Fri, 05 Sep 2003 18:22:04 +0000
Received: from [192.168.1.151] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 19vLDf-0005jT-00; Fri, 05 Sep 2003 18:22:04 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: "'Geoffrey M Clemm'" <geoffrey.clemm@us.ibm.com>, <w3c-dist-auth@w3c.org>
Date: Fri, 5 Sep 2003 11:23:04 -0700
Message-ID: <007b01c373da$c0d73560$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
In-Reply-To: <OF592A9E1C.46FE6A2C-ON85256D98.00635A43-85256D98.0063F0A8@us.ibm.com>
Importance: Normal
Old-X-Envelope-To: geoffrey.clemm@us.ibm.com,
 w3c-dist-auth@w3c.org
Subject: RE: DAV:getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/007b01c373da$c0d73560$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7853
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905182230.29ECFA05D7@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 14:22:30 -0400 (EDT)
Content-Transfer-Encoding: 7bit


> 
> Lisa (or whoever is maintaining the 2518bis issues list):
> Can this be added to the 2518bis issues list?

Yes.  However, the bindings specification should also be clear how BIND and
UNBIND work with this.  

> 
> Cheers,
> Geoff
> 
> Peter wrote on 09/05/2003 12:19:09 PM:
> 
> > AFAIK, according to RFC2518, Section 13.7, the DAV:getlastmodified
> > property is not required to be defined for collections, but a server
> > MAY define it. Is that correct?
> > Then, probably the bindings of the collection are to be considered 
> > part of the collection's state and it would make sense to set DAV:
> > getlastmodified whenever the bindings change:
> > - BIND, UNBIND (the coll identified by the req-URI) 
> > - REBIND (the coll identified by the req-URI AND the 2nd 
> involved coll) 
> > - PUT returning 201 (the containing collection) 
> > - MKCOL (the containing collection) 
> > - DELETE (the containing collection) 
> > - LOCK creating a lock-null resource (the containing collection) 
> > - VERSION-CONTROL on existing version (the containing workspace) 
> > Sorry for such a basic question, but I didn't find it in the specs. 
> > Regards, 
> > Peter 
> 
> 




From w3c-dist-auth-request@w3.org  Fri Sep  5 14:28:58 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA11099
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 14:28:57 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 6D45CA06DC; Fri,  5 Sep 2003 14:28:52 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id AC896A0880
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 14:28:28 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 332A213925; Fri,  5 Sep 2003 14:28:28 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from gate.arc.nasa.gov (gate.arc.nasa.gov [128.102.102.51])
	by dr-nick.w3.org (Postfix) with ESMTP id C49A413BA1
	for <w3c-dist-auth@w3.org>; Fri,  5 Sep 2003 14:28:27 -0400 (EDT)
Received: from nasa.gov (moonstone.aen.nasa.gov [198.123.13.108])
	by gate.arc.nasa.gov ( -- Info omitted by ASANI Solutions, LLC.) with ESMTP id h85ISRW16783;
	Fri, 5 Sep 2003 11:28:27 -0700 (PDT)
Message-ID: <3F58D5EA.4070806@nasa.gov>
Date: Fri, 05 Sep 2003 11:28:58 -0700
From: Chris Knight <Christopher.D.Knight@nasa.gov>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: frank.judge@corp.palm.com
Cc: WebDAV <w3c-dist-auth@w3.org>
References: <AMEPKEBLDJJCCDEJHAMIMEKPJBAA.ejw@cse.ucsc.edu>
In-Reply-To: <AMEPKEBLDJJCCDEJHAMIMEKPJBAA.ejw@cse.ucsc.edu>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: FW: Partial Property Data Retrieval???
X-Archived-At: http://www.w3.org/mid/3F58D5EA.4070806@nasa.gov
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7854
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905182852.6D45CA06DC@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 14:28:52 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Jim Whitehead wrote:

>For example, if you have a document object
>that has only a text property containing all the document data, you may
>only want the first 100K of a 10 megabyte document.
>
In retrospect, this is a different question...HTTP/1.1 currently 
supports the "Range" header for GET requests that would satisfy your 
requirement to download parts of document data.

See *ftp://ftp.isi.edu/in-notes/rfc2616.txt*



From w3c-dist-auth-request@w3.org  Fri Sep  5 14:58:16 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA12335
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 14:58:15 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 45E65A07A1; Fri,  5 Sep 2003 14:58:20 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 22814A0BD9
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 14:57:59 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id D16D713B60; Fri,  5 Sep 2003 14:57:58 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from smtp-relay4.palmone.com (palm-64-28-152-193.corp.palm.com [64.28.152.193])
	by dr-nick.w3.org (Postfix) with SMTP id 59A0D13AF9
	for <w3c-dist-auth@w3.org>; Fri,  5 Sep 2003 14:57:58 -0400 (EDT)
Received: from unknown(148.92.223.30) by smtp-relay4.palmone.com via csmap 
	 id 1542; Fri, 05 Sep 2003 11:57:14 -0700 (PDT)
Received: from usmilm004.palm1.palmone.com (usmilm004.palm1.palmone.com [148.92.223.48])
	by saspcp17.palmone.com (8.11.6+Sun/8.11.4) with ESMTP id h85IroF11047;
	Fri, 5 Sep 2003 11:53:50 -0700 (PDT)
Received: from usmilm005.palm1.palmone.com ([148.92.223.47]) by usmilm004.palm1.palmone.com with Microsoft SMTPSVC(5.0.2195.6713);
	 Fri, 5 Sep 2003 11:53:50 -0700
X-MimeOLE: Produced By Microsoft Exchange V6.0.6375.0
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Fri, 5 Sep 2003 11:53:50 -0700
Message-ID: <950DDBC2A9A7244AA2065E733711E76C0CBDB1@usmilm005.palm1.palmone.com>
Thread-Topic: FW: Partial Property Data Retrieval???
Thread-Index: AcNz24BYqlVj5d36TnSGCodj9CWhPwAAJm1A
From: "Frank Judge" <Frank.Judge@corp.palm.com>
To: "Chris Knight" <Christopher.D.Knight@nasa.gov>,
        "Frank Judge (Corp)" <frank.judge@corp.palm.com>
Cc: "WebDAV" <w3c-dist-auth@w3.org>
X-OriginalArrivalTime: 05 Sep 2003 18:53:50.0565 (UTC) FILETIME=[0B93E950:01C373DF]
Subject: RE: FW: Partial Property Data Retrieval???
X-Archived-At: http://www.w3.org/mid/950DDBC2A9A7244AA2065E733711E76C0CBDB1@usmilm005.palm1.palmone.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7855
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905185820.45E65A07A1@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 14:58:20 -0400 (EDT)
Content-Transfer-Encoding: quoted-printable


Chris,

Thanks for the heads up.  The only problems I see with this are:

- its optional to support byte ranges in HTTP 1.1
- if I'm understanding this right, because this is at the HTTP level, =
the entity body will basically be truncated.  This would mean only a =
partial XML document would be downloaded, and other properties coming =
after the lengthy data may be missing, as well as the terminating XML =
tags.  Would this be your understanding also, or would you expect the =
WebDAV server implementation to respect the RANGE header, and only =
return the number of bytes for the large PROPERTY instead of the entire =
HTTP entity body?
- I can't find a server that supports the "Range: bytes=3D" header.  At =
least Microsoft's IIS server for Exchange 2003 does not.

Any idea if this has come up for discussion in the WebDAV specs prior, =
or if it could be proposed?  Basically something like specifying a byte =
RANGE when asking for a specific property would do the trick.  I'll look =
at the XPATH reference you previously forwarded.

Thanks for you help,

Frank

-----Original Message-----
From: Chris Knight [mailto:Christopher.D.Knight@nasa.gov]
Sent: Friday, September 05, 2003 2:29 PM
To: Frank Judge (Corp)
Cc: WebDAV
Subject: Re: FW: Partial Property Data Retrieval???


Jim Whitehead wrote:

>For example, if you have a document object
>that has only a text property containing all the document data, you may
>only want the first 100K of a 10 megabyte document.
>
In retrospect, this is a different question...HTTP/1.1 currently=20
supports the "Range" header for GET requests that would satisfy your=20
requirement to download parts of document data.

See *ftp://ftp.isi.edu/in-notes/rfc2616.txt*





From w3c-dist-auth-request@w3.org  Fri Sep  5 15:59:56 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15902
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 15:59:56 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 27FD4A0E7C; Fri,  5 Sep 2003 15:59:51 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id BC8FBA0E8E
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 15:59:38 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id C77A113D09; Fri,  5 Sep 2003 15:33:23 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from e6.ny.us.ibm.com (e6.ny.us.ibm.com [32.97.182.106])
	by dr-nick.w3.org (Postfix) with ESMTP id A95FD13BCE
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 15:33:23 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e6.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h85JXMSO177226;
	Fri, 5 Sep 2003 15:33:22 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h85JXLcU059894;
	Fri, 5 Sep 2003 15:33:21 -0400
In-Reply-To: <007b01c373da$c0d73560$f8cb90c6@lisalap>
To: "Lisa Dusseault" <lisa@xythos.com>
Cc: w3c-dist-auth@w3c.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
Message-ID: <OF473FB777.701A454A-ON85256D98.006B3886-85256D98.006B6D24@us.ibm.com>
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Date: Fri, 5 Sep 2003 15:33:22 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/05/2003 15:33:21,
	Serialize complete at 09/05/2003 15:33:21
Content-Type: text/plain; charset="US-ASCII"
Subject: RE: DAV:getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/OF473FB777.701A454A-ON85256D98.006B3886-85256D98.006B6D24@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7856
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905195951.27FD4A0E7C@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 15:59:51 -0400 (EDT)


That's fine, but the binding spec needs to follow whatever decision is 
made by
the spec defining DAV:getlastmodified (which is RFC2518).  So the
binding spec can't be clear on it until RFC2518 is clear on it.

Cheers,
Geoff

"Lisa Dusseault" <lisa@xythos.com> wrote on 09/05/2003 02:23:04 PM:

> > 
> > Lisa (or whoever is maintaining the 2518bis issues list):
> > Can this be added to the 2518bis issues list?
> 
> Yes.  However, the bindings specification should also be clear how BIND 
and
> UNBIND work with this. 
> 
> > 
> > Cheers,
> > Geoff
> > 
> > Peter wrote on 09/05/2003 12:19:09 PM:
> > 
> > > AFAIK, according to RFC2518, Section 13.7, the DAV:getlastmodified
> > > property is not required to be defined for collections, but a server
> > > MAY define it. Is that correct?
> > > Then, probably the bindings of the collection are to be considered 
> > > part of the collection's state and it would make sense to set DAV:
> > > getlastmodified whenever the bindings change:
> > > - BIND, UNBIND (the coll identified by the req-URI) 
> > > - REBIND (the coll identified by the req-URI AND the 2nd 
> > involved coll) 
> > > - PUT returning 201 (the containing collection) 
> > > - MKCOL (the containing collection) 
> > > - DELETE (the containing collection) 
> > > - LOCK creating a lock-null resource (the containing collection) 
> > > - VERSION-CONTROL on existing version (the containing workspace) 
> > > Sorry for such a basic question, but I didn't find it in the specs. 
> > > Regards, 
> > > Peter 
> > 
> > 
> 
> 



From w3c-dist-auth-request@w3.org  Fri Sep  5 17:53:49 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA21203
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 17:53:49 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id E4950A06DC; Fri,  5 Sep 2003 17:53:17 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id BF197A0EC3
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 17:53:15 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 806D913B69; Fri,  5 Sep 2003 17:53:15 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.gmx.net (mail.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 1A6F913674
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 17:53:15 -0400 (EDT)
Received: (qmail 23622 invoked by uid 65534); 5 Sep 2003 21:53:04 -0000
Received: from pD950C3A6.dip.t-dialin.net (HELO lisa) (217.80.195.166)
  by mail.gmx.net (mp027) with SMTP; 05 Sep 2003 23:53:04 +0200
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Nevermann, Dr., Peter" <Peter.Nevermann@softwareag.com>,
        <w3c-dist-auth@w3c.org>
Date: Fri, 5 Sep 2003 23:52:25 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCEEANIGAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
In-reply-to: <DFF2AC9E3583D511A21F0008C7E6210605C4807D@daemsg02.software-ag.de>
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
Subject: RE: getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCEEANIGAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7857
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905215317.E4950A06DC@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 17:53:17 -0400 (EDT)
Content-Transfer-Encoding: 7bit


> From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]On
> Behalf Of Nevermann, Dr., Peter
> Sent: Friday, September 05, 2003 6:19 PM
> To: 'w3c-dist-auth@w3c.org'
> Subject: DAV:getlastmodified of collections
>
>
> AFAIK, according to RFC2518, Section 13.7, the
> DAV:getlastmodified property
> is not required to be defined for collections, but a server MAY define it.
> Is that correct?

Actually, it's not really required at all. A server should provide a
DAV:getlastmodified property for any resource for which it actually would
also provide the last-modified header upon GET. So a collection may have
GETtable content (in which case DAV:getlastmodified should be present), and
then also a server may not even have the last-modified date for a plain
resource (for instance if it's clockless).

> Then, probably the bindings of the collection are to be considered part of
> the collection's state and it would make sense to set DAV:getlastmodified
> whenever the bindings change:

I agree although I have to point out that properties *also* are part of the
state of a collection, and the current consensus seems to be that the
last-modified date should not change when the content doesn't. So this is
non-obvious.

> - BIND, UNBIND (the coll identified by the req-URI)
> - REBIND (the coll identified by the req-URI AND the 2nd involved coll)
> - PUT returning 201 (the containing collection)
> - MKCOL (the containing collection)
> - DELETE (the containing collection)
> - LOCK creating a lock-null resource (the containing collection)
> - VERSION-CONTROL on existing version (the containing workspace)

Yes.

> Sorry for such a basic question, but I didn't find it in the specs.

No, it's good to ask these kinds of questions.

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760



From w3c-dist-auth-request@w3.org  Fri Sep  5 17:55:00 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA21294
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 17:54:59 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 55145A0D95; Fri,  5 Sep 2003 17:55:05 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 5B30AA0D95
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 17:55:03 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id F214F13360; Fri,  5 Sep 2003 17:55:02 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.gmx.net (mail.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 684AD13B13
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 17:55:01 -0400 (EDT)
Received: (qmail 2934 invoked by uid 65534); 5 Sep 2003 21:54:52 -0000
Received: from pD950C3A6.dip.t-dialin.net (HELO lisa) (217.80.195.166)
  by mail.gmx.net (mp025) with SMTP; 05 Sep 2003 23:54:52 +0200
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Geoffrey M Clemm" <geoffrey.clemm@us.ibm.com>, <w3c-dist-auth@w3c.org>
Date: Fri, 5 Sep 2003 23:54:12 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCIEANIGAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
In-reply-to: <OF592A9E1C.46FE6A2C-ON85256D98.00635A43-85256D98.0063F0A8@us.ibm.com>
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
Subject: RE: DAV:getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCIEANIGAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7858
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905215505.55145A0D95@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 17:55:05 -0400 (EDT)
Content-Transfer-Encoding: 7bit


> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Geoffrey M Clemm
> Sent: Friday, September 05, 2003 8:12 PM
> To: 'w3c-dist-auth@w3c.org'
> Subject: Re: DAV:getlastmodified of collections
>
>
>
> Also, MOVE (on the collections containing the source and destination).
> Also, COPY (on the collections containing any new resources
> created by the
> COPY).
> One correction: VERSION-CONTROL affects the state of the collection
> containing the resource being created, not on the containing workspace
> (unless the workspace is the collection containing the resource).

Hm. Does it affect the state of a parent collection if it (the collection)
isn't version-controlled? In this case the state of the collection IMHO
doesn't (or doesn't need to) change.

> ...

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760




From w3c-dist-auth-request@w3.org  Fri Sep  5 18:03:06 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21788
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 18:03:05 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 1CDF9A08A0; Fri,  5 Sep 2003 18:03:11 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id B6FC0A0E92
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 18:03:09 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 6813D13AF9; Fri,  5 Sep 2003 18:03:09 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from e1.ny.us.ibm.com (e1.ny.us.ibm.com [32.97.182.101])
	by dr-nick.w3.org (Postfix) with ESMTP id 570C613B15
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 18:03:09 -0400 (EDT)
Received: from northrelay02.pok.ibm.com (northrelay02.pok.ibm.com [9.56.224.150] (may be forged))
	by e1.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h85M39g2177466
	for <w3c-dist-auth@w3c.org>; Fri, 5 Sep 2003 18:03:09 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay02.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h85M37gr051736
	for <w3c-dist-auth@w3c.org>; Fri, 5 Sep 2003 18:03:08 -0400
In-Reply-To: <JIEGINCHMLABHJBIGKBCIEANIGAA.julian.reschke@gmx.de>
To: w3c-dist-auth@w3c.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
Message-ID: <OF0B81860D.AB69925D-ON85256D98.0078F2C6-85256D98.0079228C@us.ibm.com>
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Date: Fri, 5 Sep 2003 18:03:06 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/05/2003 18:03:08,
	Serialize complete at 09/05/2003 18:03:08
Content-Type: text/plain; charset="US-ASCII"
Subject: RE: DAV:getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/OF0B81860D.AB69925D-ON85256D98.0078F2C6-85256D98.0079228C@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7859
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905220311.1CDF9A08A0@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 18:03:11 -0400 (EDT)


I was referring to the VERSION-CONTROL bullet in Peter's
original message, i.e. VERSION-CONTROL with a version argument
(which always creates a new version-controlled resource).

For VERSION-CONTROL without a version argument (which never
creates a new version-controlled resource), you are correct
that it does not affect the state of the parent collection.

Cheers,
Geoff


Julian wrote on 09/05/2003 05:54:12 PM:

> 
> > From: w3c-dist-auth-request@w3.org
> > [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Geoffrey M Clemm
> > Sent: Friday, September 05, 2003 8:12 PM
> > To: 'w3c-dist-auth@w3c.org'
> > Subject: Re: DAV:getlastmodified of collections
> >
> >
> >
> > Also, MOVE (on the collections containing the source and destination).
> > Also, COPY (on the collections containing any new resources
> > created by the
> > COPY).
> > One correction: VERSION-CONTROL affects the state of the collection
> > containing the resource being created, not on the containing workspace
> > (unless the workspace is the collection containing the resource).
> 
> Hm. Does it affect the state of a parent collection if it (the 
collection)
> isn't version-controlled? In this case the state of the collection IMHO
> doesn't (or doesn't need to) change.
> 
> > ...
> 
> Julian



From w3c-dist-auth-request@w3.org  Fri Sep  5 18:08:31 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA22451
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 18:08:31 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 30F49A0A45; Fri,  5 Sep 2003 18:08:36 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 1E92EA0A45
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 18:08:34 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id BBBCC13866; Fri,  5 Sep 2003 18:08:33 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.gmx.net (mail.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 5013913448
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 18:08:33 -0400 (EDT)
Received: (qmail 23223 invoked by uid 65534); 5 Sep 2003 22:08:32 -0000
Received: from pD950C3A6.dip.t-dialin.net (HELO lisa) (217.80.195.166)
  by mail.gmx.net (mp012) with SMTP; 06 Sep 2003 00:08:32 +0200
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Geoffrey M Clemm" <geoffrey.clemm@us.ibm.com>, <w3c-dist-auth@w3c.org>
Date: Sat, 6 Sep 2003 00:08:11 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCGEAOIGAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
In-reply-to: <OF0B81860D.AB69925D-ON85256D98.0078F2C6-85256D98.0079228C@us.ibm.com>
Importance: Normal
Subject: RE: DAV:getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCGEAOIGAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7860
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905220836.30F49A0A45@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 18:08:36 -0400 (EDT)
Content-Transfer-Encoding: 7bit


I see.

But then we're missing the case of VERSION-CONTROL on a versionable but not
yet version-controlled resource that lives inside a versioned collection (in
which case I'd say the state of the parent collection *does* change).

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Geoffrey M Clemm
> Sent: Saturday, September 06, 2003 12:03 AM
> To: w3c-dist-auth@w3c.org
> Subject: RE: DAV:getlastmodified of collections
>
>
>
> I was referring to the VERSION-CONTROL bullet in Peter's
> original message, i.e. VERSION-CONTROL with a version argument
> (which always creates a new version-controlled resource).
>
> For VERSION-CONTROL without a version argument (which never
> creates a new version-controlled resource), you are correct
> that it does not affect the state of the parent collection.
>
> Cheers,
> Geoff
>
>
> Julian wrote on 09/05/2003 05:54:12 PM:
>
> >
> > > From: w3c-dist-auth-request@w3.org
> > > [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Geoffrey M Clemm
> > > Sent: Friday, September 05, 2003 8:12 PM
> > > To: 'w3c-dist-auth@w3c.org'
> > > Subject: Re: DAV:getlastmodified of collections
> > >
> > >
> > >
> > > Also, MOVE (on the collections containing the source and destination).
> > > Also, COPY (on the collections containing any new resources
> > > created by the
> > > COPY).
> > > One correction: VERSION-CONTROL affects the state of the collection
> > > containing the resource being created, not on the containing workspace
> > > (unless the workspace is the collection containing the resource).
> >
> > Hm. Does it affect the state of a parent collection if it (the
> collection)
> > isn't version-controlled? In this case the state of the collection IMHO
> > doesn't (or doesn't need to) change.
> >
> > > ...
> >
> > Julian
>



From w3c-dist-auth-request@w3.org  Fri Sep  5 18:15:54 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA23282
	for <webdav-archive@lists.ietf.org>; Fri, 5 Sep 2003 18:15:53 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 2AAF5A05D8; Fri,  5 Sep 2003 18:15:59 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 75532A05D8
	for <w3c-dist-auth@frink.w3.org>; Fri,  5 Sep 2003 18:15:56 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 0F193139B7; Fri,  5 Sep 2003 18:15:56 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id CEF8613866
	for <w3c-dist-auth@w3c.org>; Fri,  5 Sep 2003 18:15:55 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 19vOry-00026S-00; Fri, 05 Sep 2003 22:15:54 +0000
Received: from [192.168.1.151] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 19vOry-00026B-00; Fri, 05 Sep 2003 22:15:54 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: "'Julian Reschke'" <julian.reschke@gmx.de>,
        "'Nevermann, Dr., Peter'" <Peter.Nevermann@softwareag.com>,
        <w3c-dist-auth@w3c.org>
Date: Fri, 5 Sep 2003 15:16:56 -0700
Message-ID: <009a01c373fb$6b59d220$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
In-Reply-To: <JIEGINCHMLABHJBIGKBCEEANIGAA.julian.reschke@gmx.de>
Importance: Normal
Old-X-Envelope-To: julian.reschke@gmx.de,
 Peter.Nevermann@softwareag.com,
 w3c-dist-auth@w3c.org
Subject: RE: getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/009a01c373fb$6b59d220$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7861
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030905221559.2AAF5A05D8@frink.w3.org>
Resent-Date: Fri,  5 Sep 2003 18:15:59 -0400 (EDT)
Content-Transfer-Encoding: quoted-printable


This is a good point.  I was thinking that the GET response to a =
directory
was likely only a=20
listing of its member files, and then Geoff's idea of getlastmodified =
would
fit this model.
However there are a number of other possibilities:

 - If the server includes information about a directory's members, that
could change.  E.g.
	File Name		Size		Last Modified
	file1.txt		123k		8/1/2003
	file2.txt		124k		8/2/2003
   A server that did a listing like this in response to a GET ought to
change its directory's
   getlastmodified value whenever the content changed. Obviously that =
might
include a PUT
   operation to a child as well as the other operations listed.

 - If the server returns a file like "index.html" in response to a GET =
for a
directory, then
   possibly the 'getlastmodified' property value for the directory =
should be
that of=20
   the index.html file.

How many HTTP/WebDAV clients are there out there that do caching/synch =
based
on the=20
Last-Modified header or the 'getlastmodified' property?  I am guessing =
there
are quite
a few because from what I've seen clients can't rely on ETag support in
Web/WebDAV servers.

Lisa


> -----Original Message-----
> From: w3c-dist-auth-request@w3.org=20
> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Julian Reschke
> Sent: Friday, September 05, 2003 2:52 PM
> To: Nevermann, Dr., Peter; w3c-dist-auth@w3c.org
> Subject: RE: getlastmodified of collections
>=20
>=20
>=20
> > From: w3c-dist-auth-request@w3.org=20
> > [mailto:w3c-dist-auth-request@w3.org]On
> > Behalf Of Nevermann, Dr., Peter
> > Sent: Friday, September 05, 2003 6:19 PM
> > To: 'w3c-dist-auth@w3c.org'
> > Subject: DAV:getlastmodified of collections
> >
> >
> > AFAIK, according to RFC2518, Section 13.7, the DAV:getlastmodified=20
> > property is not required to be defined for collections, but=20
> a server=20
> > MAY define it. Is that correct?
>=20
> Actually, it's not really required at all. A server should=20
> provide a DAV:getlastmodified property for any resource for=20
> which it actually would also provide the last-modified header=20
> upon GET. So a collection may have GETtable content (in which=20
> case DAV:getlastmodified should be present), and then also a=20
> server may not even have the last-modified date for a plain=20
> resource (for instance if it's clockless).
>=20
> > Then, probably the bindings of the collection are to be considered=20
> > part of the collection's state and it would make sense to set=20
> > DAV:getlastmodified whenever the bindings change:
>=20
> I agree although I have to point out that properties *also*=20
> are part of the state of a collection, and the current=20
> consensus seems to be that the last-modified date should not=20
> change when the content doesn't. So this is non-obvious.
>=20
> > - BIND, UNBIND (the coll identified by the req-URI)
> > - REBIND (the coll identified by the req-URI AND the 2nd involved=20
> > coll)
> > - PUT returning 201 (the containing collection)
> > - MKCOL (the containing collection)
> > - DELETE (the containing collection)
> > - LOCK creating a lock-null resource (the containing collection)
> > - VERSION-CONTROL on existing version (the containing workspace)
>=20
> Yes.
>=20
> > Sorry for such a basic question, but I didn't find it in the specs.
>=20
> No, it's good to ask these kinds of questions.
>=20
> Julian
>=20
> --
> <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
>=20
>=20




From w3c-dist-auth-request@w3.org  Sat Sep  6 05:46:48 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA02644
	for <webdav-archive@lists.ietf.org>; Sat, 6 Sep 2003 05:46:47 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 4F2ABA0F57; Sat,  6 Sep 2003 05:46:49 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 1D79BA0F57
	for <w3c-dist-auth@frink.w3.org>; Sat,  6 Sep 2003 05:46:43 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id D9ED713CF7; Sat,  6 Sep 2003 05:46:42 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.gmx.net (pop.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 7134913D00
	for <w3c-dist-auth@w3c.org>; Sat,  6 Sep 2003 05:46:41 -0400 (EDT)
Received: (qmail 26233 invoked by uid 65534); 6 Sep 2003 09:46:40 -0000
Received: from pD950C3A6.dip.t-dialin.net (HELO lisa) (217.80.195.166)
  by mail.gmx.net (mp016) with SMTP; 06 Sep 2003 11:46:40 +0200
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Lisa Dusseault" <lisa@xythos.com>,
        "'Julian Reschke'" <julian.reschke@gmx.de>,
        "'Nevermann, Dr., Peter'" <Peter.Nevermann@softwareag.com>,
        <w3c-dist-auth@w3c.org>
Date: Sat, 6 Sep 2003 11:46:28 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCKEBIIGAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
In-Reply-To: <009a01c373fb$6b59d220$f8cb90c6@lisalap>
Importance: Normal
Subject: RE: getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCKEBIIGAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7862
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030906094649.4F2ABA0F57@frink.w3.org>
Resent-Date: Sat,  6 Sep 2003 05:46:49 -0400 (EDT)
Content-Transfer-Encoding: 7bit


> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Lisa Dusseault
> Sent: Saturday, September 06, 2003 12:17 AM
> To: 'Julian Reschke'; 'Nevermann, Dr., Peter'; w3c-dist-auth@w3c.org
> Subject: RE: getlastmodified of collections
>
>
>
> This is a good point.  I was thinking that the GET response to a directory
was likely only a
> listing of its member files, and then Geoff's idea of getlastmodified
would fit this model.

Yes.

> However there are a number of other possibilities:
>
>  - If the server includes information about a directory's members, that
could change.  E.g.
> 	File Name		Size		Last Modified
> 	file1.txt		123k		8/1/2003
> 	file2.txt		124k		8/2/2003
>    A server that did a listing like this in response to a GET ought to
change its directory's
>    getlastmodified value whenever the content changed. Obviously that
might include a PUT
>    operation to a child as well as the other operations listed.

Correct.

>  - If the server returns a file like "index.html" in response to a GET for
a directory, then
>    possibly the 'getlastmodified' property value for the directory should
be that of
>    the index.html file.

Yes.

> How many HTTP/WebDAV clients are there out there that do caching/synch
based on the
> Last-Modified header or the 'getlastmodified' property?  I am guessing
there are quite
> a few because from what I've seen clients can't rely on ETag support in
Web/WebDAV servers.

I think most user agents will cache using the Last-Modified *header* when no
ETag is present. I however doubt that there are lots of WebDAV-aware clients
that actually use DAV:getlastmodified to cache (they'd still need to GET the
content, in which case they SHOULD use the "Last-Modified" header returned
by GET).

In general, all we can say reliably is that the Last-Modified date should
change when the GETtable content changes. Now the real issue here is: is the
timestamp allowed to change even though the content didn't. We ruled that
out for property changes (which I think is wrong), but seem to propose it
for other non-content changes here.

See also
<http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JulSep/0122.html>,
part 2.

Julian
--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760



From w3c-dist-auth-request@w3.org  Mon Sep  8 08:10:44 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA14790
	for <webdav-archive@lists.ietf.org>; Mon, 8 Sep 2003 08:10:44 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id B6E29A090A; Mon,  8 Sep 2003 08:10:49 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 7894CA090A
	for <w3c-dist-auth@frink.w3.org>; Mon,  8 Sep 2003 08:10:47 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 14FB51363C; Mon,  8 Sep 2003 08:10:47 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from e5.ny.us.ibm.com (e5.ny.us.ibm.com [32.97.182.105])
	by dr-nick.w3.org (Postfix) with ESMTP id EAC4A1348D
	for <w3c-dist-auth@w3c.org>; Mon,  8 Sep 2003 08:10:46 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e5.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h88CAk0H229962
	for <w3c-dist-auth@w3c.org>; Mon, 8 Sep 2003 08:10:46 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h88CAjWo066784
	for <w3c-dist-auth@w3c.org>; Mon, 8 Sep 2003 08:10:45 -0400
In-Reply-To: <JIEGINCHMLABHJBIGKBCGEAOIGAA.julian.reschke@gmx.de>
To: w3c-dist-auth@w3c.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Message-ID: <OFCC3AF710.B7939216-ON85256D9B.000B1A75-85256D9B.0042E587@us.ibm.com>
Date: Mon, 8 Sep 2003 08:10:41 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/08/2003 08:10:45,
	Serialize complete at 09/08/2003 08:10:45
Content-Type: multipart/alternative; boundary="=_alternative 000BB54185256D9B_="
Subject: RE: DAV:getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/OFCC3AF710.B7939216-ON85256D9B.000B1A75-85256D9B.0042E587@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7863
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030908121049.B6E29A090A@frink.w3.org>
Resent-Date: Mon,  8 Sep 2003 08:10:49 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 000BB54185256D9B_=
Content-Type: text/plain; charset="US-ASCII"

"Julian Reschke" <julian.reschke@gmx.de> wrote on 09/05/2003 06:08:11 PM:
> But then we're missing the case of VERSION-CONTROL on a versionable but 
not
> yet version-controlled resource that lives inside a versioned collection 
(in
> which case I'd say the state of the parent collection *does* change).

I suggest we keep the semantics very simple, and say that 
DAV:getlastmodified
is changed only by adding a binding, removing a binding, or changing a 
binding
to new resource.  Putting an existing resource under version control does
none of these things, so it should not result in an update to 
DAV:getlastmodified.

Note that in general the "version-controlled state" of a collection will 
be
different from the "state" of a collection, i.e. adding and removing a 
binding
to a non-version-controlled resource does not change the 
version-controlled
state of a collection, but does change the state of the collection.

Cheers,
Geoff

--=_alternative 000BB54185256D9B_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2><tt>&quot;Julian Reschke&quot; &lt;julian.reschke@gmx.de&gt;
wrote on 09/05/2003 06:08:11 PM:<br>
&gt; But then we're missing the case of VERSION-CONTROL on a versionable
but not<br>
&gt; yet version-controlled resource that lives inside a versioned collection
(in<br>
&gt; which case I'd say the state of the parent collection *does* change).<br>
</tt></font>
<br><font size=2><tt>I suggest we keep the semantics very simple, and say
that DAV:getlastmodified</tt></font>
<br><font size=2><tt>is changed only by adding a binding, removing a binding,
or changing a binding</tt></font>
<br><font size=2><tt>to new resource. &nbsp;Putting an existing resource
under version control does</tt></font>
<br><font size=2><tt>none of these things, so it should not result in an
update to DAV:getlastmodified.</tt></font>
<br>
<br><font size=2><tt>Note that in general the &quot;version-controlled
state&quot; of a collection will be</tt></font>
<br><font size=2><tt>different from the &quot;state&quot; of a collection,
i.e. adding and removing a binding</tt></font>
<br><font size=2><tt>to a non-version-controlled resource does not change
the version-controlled</tt></font>
<br><font size=2><tt>state of a collection, but does change the state of
the collection.</tt></font>
<br>
<br><font size=2><tt>Cheers,</tt></font>
<br><font size=2><tt>Geoff</tt></font>
<br>
--=_alternative 000BB54185256D9B_=--



From w3c-dist-auth-request@w3.org  Mon Sep  8 08:11:11 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA14844
	for <webdav-archive@lists.ietf.org>; Mon, 8 Sep 2003 08:11:11 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id D7A80A0DE9; Mon,  8 Sep 2003 08:10:57 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id C6333A0DE9
	for <w3c-dist-auth@frink.w3.org>; Mon,  8 Sep 2003 08:10:56 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 628201410F; Mon,  8 Sep 2003 08:10:56 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from e6.ny.us.ibm.com (e6.ny.us.ibm.com [32.97.182.106])
	by dr-nick.w3.org (Postfix) with ESMTP id 409C5140FA
	for <w3c-dist-auth@w3c.org>; Mon,  8 Sep 2003 08:10:56 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e6.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h88CAuWq684930
	for <w3c-dist-auth@w3c.org>; Mon, 8 Sep 2003 08:10:56 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h88CAsWo054126
	for <w3c-dist-auth@w3c.org>; Mon, 8 Sep 2003 08:10:55 -0400
In-Reply-To: <009a01c373fb$6b59d220$f8cb90c6@lisalap>
To: w3c-dist-auth@w3c.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Message-ID: <OFF1E3105C.5C14F114-ON85256D9B.000DF33A-85256D9B.0042E846@us.ibm.com>
Date: Mon, 8 Sep 2003 08:10:48 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/08/2003 08:10:55,
	Serialize complete at 09/08/2003 08:10:55
Content-Type: multipart/alternative; boundary="=_alternative 000E026B85256D9B_="
Subject: RE: getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/OFF1E3105C.5C14F114-ON85256D9B.000DF33A-85256D9B.0042E846@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7864
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030908121057.D7A80A0DE9@frink.w3.org>
Resent-Date: Mon,  8 Sep 2003 08:10:57 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 000E026B85256D9B_=
Content-Type: text/plain; charset="US-ASCII"

I agree with Lisa's observations below, and my conclusion is that since
the behavior of GET on a collection is not defined, the behavior of
DAV:getlastmodified should not be defined, since the purpose
of the Last-Modified header is to support caching of the GET request.

So until 2518 defines server-independent behavior of GET on a collection
2518 should remain silent on DAV:getlastmodified on a collection.

Cheers,
Geoff

w3c-dist-auth-request@w3.org wrote on 09/05/2003 06:16:56 PM:

> 
> This is a good point.  I was thinking that the GET response to a 
directory
> was likely only a 
> listing of its member files, and then Geoff's idea of getlastmodified 
would
> fit this model.
> However there are a number of other possibilities:
> 
>  - If the server includes information about a directory's members, that
> could change.  E.g.
>    File Name      Size      Last Modified
>    file1.txt      123k      8/1/2003
>    file2.txt      124k      8/2/2003
>    A server that did a listing like this in response to a GET ought to
> change its directory's
>    getlastmodified value whenever the content changed. Obviously that 
might
> include a PUT
>    operation to a child as well as the other operations listed.
> 
>  - If the server returns a file like "index.html" in response to a GET 
for a
> directory, then
>    possibly the 'getlastmodified' property value for the directory 
should be
> that of 
>    the index.html file.
> 
> How many HTTP/WebDAV clients are there out there that do caching/synch 
based
> on the 
> Last-Modified header or the 'getlastmodified' property?  I am guessing 
there
> are quite
> a few because from what I've seen clients can't rely on ETag support in
> Web/WebDAV servers.
> 
> Lisa
> 
> 
> > -----Original Message-----
> > From: w3c-dist-auth-request@w3.org 
> > [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Julian Reschke
> > Sent: Friday, September 05, 2003 2:52 PM
> > To: Nevermann, Dr., Peter; w3c-dist-auth@w3c.org
> > Subject: RE: getlastmodified of collections
> > 
> > 
> > 
> > > From: w3c-dist-auth-request@w3.org 
> > > [mailto:w3c-dist-auth-request@w3.org]On
> > > Behalf Of Nevermann, Dr., Peter
> > > Sent: Friday, September 05, 2003 6:19 PM
> > > To: 'w3c-dist-auth@w3c.org'
> > > Subject: DAV:getlastmodified of collections
> > >
> > >
> > > AFAIK, according to RFC2518, Section 13.7, the DAV:getlastmodified 
> > > property is not required to be defined for collections, but 
> > a server 
> > > MAY define it. Is that correct?
> > 
> > Actually, it's not really required at all. A server should 
> > provide a DAV:getlastmodified property for any resource for 
> > which it actually would also provide the last-modified header 
> > upon GET. So a collection may have GETtable content (in which 
> > case DAV:getlastmodified should be present), and then also a 
> > server may not even have the last-modified date for a plain 
> > resource (for instance if it's clockless).
> > 
> > > Then, probably the bindings of the collection are to be considered 
> > > part of the collection's state and it would make sense to set 
> > > DAV:getlastmodified whenever the bindings change:
> > 
> > I agree although I have to point out that properties *also* 
> > are part of the state of a collection, and the current 
> > consensus seems to be that the last-modified date should not 
> > change when the content doesn't. So this is non-obvious.
> > 
> > > - BIND, UNBIND (the coll identified by the req-URI)
> > > - REBIND (the coll identified by the req-URI AND the 2nd involved 
> > > coll)
> > > - PUT returning 201 (the containing collection)
> > > - MKCOL (the containing collection)
> > > - DELETE (the containing collection)
> > > - LOCK creating a lock-null resource (the containing collection)
> > > - VERSION-CONTROL on existing version (the containing workspace)
> > 
> > Yes.
> > 
> > > Sorry for such a basic question, but I didn't find it in the specs.
> > 
> > No, it's good to ask these kinds of questions.
> > 
> > Julian
> > 
> > --
> > <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
> > 
> > 
> 
> 

--=_alternative 000E026B85256D9B_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2><tt>I agree with Lisa's observations below, and my conclusion
is that since</tt></font>
<br><font size=2><tt>the behavior of GET on a collection is not defined,
the behavior of</tt></font>
<br><font size=2><tt>DAV:getlastmodified should not be defined, since the
purpose</tt></font>
<br><font size=2><tt>of the Last-Modified header is to support caching
of the GET request.</tt></font>
<br>
<br><font size=2><tt>So until 2518 defines server-independent behavior
of GET on a collection</tt></font>
<br><font size=2><tt>2518 should remain silent on DAV:getlastmodified on
a collection.</tt></font>
<br>
<br><font size=2><tt>Cheers,</tt></font>
<br><font size=2><tt>Geoff</tt></font>
<br>
<br><font size=2><tt>w3c-dist-auth-request@w3.org wrote on 09/05/2003 06:16:56
PM:<br>
<br>
&gt; <br>
&gt; This is a good point. &nbsp;I was thinking that the GET response to
a directory<br>
&gt; was likely only a <br>
&gt; listing of its member files, and then Geoff's idea of getlastmodified
would<br>
&gt; fit this model.<br>
&gt; However there are a number of other possibilities:<br>
&gt; <br>
&gt; &nbsp;- If the server includes information about a directory's members,
that<br>
&gt; could change. &nbsp;E.g.<br>
&gt; &nbsp; &nbsp;File Name &nbsp; &nbsp; &nbsp;Size &nbsp; &nbsp; &nbsp;Last
Modified<br>
&gt; &nbsp; &nbsp;file1.txt &nbsp; &nbsp; &nbsp;123k &nbsp; &nbsp; &nbsp;8/1/2003<br>
&gt; &nbsp; &nbsp;file2.txt &nbsp; &nbsp; &nbsp;124k &nbsp; &nbsp; &nbsp;8/2/2003<br>
&gt; &nbsp; &nbsp;A server that did a listing like this in response to
a GET ought to<br>
&gt; change its directory's<br>
&gt; &nbsp; &nbsp;getlastmodified value whenever the content changed. Obviously
that might<br>
&gt; include a PUT<br>
&gt; &nbsp; &nbsp;operation to a child as well as the other operations
listed.<br>
&gt; <br>
&gt; &nbsp;- If the server returns a file like &quot;index.html&quot; in
response to a GET for a<br>
&gt; directory, then<br>
&gt; &nbsp; &nbsp;possibly the 'getlastmodified' property value for the
directory should be<br>
&gt; that of <br>
&gt; &nbsp; &nbsp;the index.html file.<br>
&gt; <br>
&gt; How many HTTP/WebDAV clients are there out there that do caching/synch
based<br>
&gt; on the <br>
&gt; Last-Modified header or the 'getlastmodified' property? &nbsp;I am
guessing there<br>
&gt; are quite<br>
&gt; a few because from what I've seen clients can't rely on ETag support
in<br>
&gt; Web/WebDAV servers.<br>
&gt; <br>
&gt; Lisa<br>
&gt; <br>
&gt; <br>
&gt; &gt; -----Original Message-----<br>
&gt; &gt; From: w3c-dist-auth-request@w3.org <br>
&gt; &gt; [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Julian Reschke<br>
&gt; &gt; Sent: Friday, September 05, 2003 2:52 PM<br>
&gt; &gt; To: Nevermann, Dr., Peter; w3c-dist-auth@w3c.org<br>
&gt; &gt; Subject: RE: getlastmodified of collections<br>
&gt; &gt; <br>
&gt; &gt; <br>
&gt; &gt; <br>
&gt; &gt; &gt; From: w3c-dist-auth-request@w3.org <br>
&gt; &gt; &gt; [mailto:w3c-dist-auth-request@w3.org]On<br>
&gt; &gt; &gt; Behalf Of Nevermann, Dr., Peter<br>
&gt; &gt; &gt; Sent: Friday, September 05, 2003 6:19 PM<br>
&gt; &gt; &gt; To: 'w3c-dist-auth@w3c.org'<br>
&gt; &gt; &gt; Subject: DAV:getlastmodified of collections<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt;<br>
&gt; &gt; &gt; AFAIK, according to RFC2518, Section 13.7, the DAV:getlastmodified
<br>
&gt; &gt; &gt; property is not required to be defined for collections,
but <br>
&gt; &gt; a server <br>
&gt; &gt; &gt; MAY define it. Is that correct?<br>
&gt; &gt; <br>
&gt; &gt; Actually, it's not really required at all. A server should <br>
&gt; &gt; provide a DAV:getlastmodified property for any resource for <br>
&gt; &gt; which it actually would also provide the last-modified header
<br>
&gt; &gt; upon GET. So a collection may have GETtable content (in which
<br>
&gt; &gt; case DAV:getlastmodified should be present), and then also a
<br>
&gt; &gt; server may not even have the last-modified date for a plain <br>
&gt; &gt; resource (for instance if it's clockless).<br>
&gt; &gt; <br>
&gt; &gt; &gt; Then, probably the bindings of the collection are to be
considered <br>
&gt; &gt; &gt; part of the collection's state and it would make sense to
set <br>
&gt; &gt; &gt; DAV:getlastmodified whenever the bindings change:<br>
&gt; &gt; <br>
&gt; &gt; I agree although I have to point out that properties *also* <br>
&gt; &gt; are part of the state of a collection, and the current <br>
&gt; &gt; consensus seems to be that the last-modified date should not
<br>
&gt; &gt; change when the content doesn't. So this is non-obvious.<br>
&gt; &gt; <br>
&gt; &gt; &gt; - BIND, UNBIND (the coll identified by the req-URI)<br>
&gt; &gt; &gt; - REBIND (the coll identified by the req-URI AND the 2nd
involved <br>
&gt; &gt; &gt; coll)<br>
&gt; &gt; &gt; - PUT returning 201 (the containing collection)<br>
&gt; &gt; &gt; - MKCOL (the containing collection)<br>
&gt; &gt; &gt; - DELETE (the containing collection)<br>
&gt; &gt; &gt; - LOCK creating a lock-null resource (the containing collection)<br>
&gt; &gt; &gt; - VERSION-CONTROL on existing version (the containing workspace)<br>
&gt; &gt; <br>
&gt; &gt; Yes.<br>
&gt; &gt; <br>
&gt; &gt; &gt; Sorry for such a basic question, but I didn't find it in
the specs.<br>
&gt; &gt; <br>
&gt; &gt; No, it's good to ask these kinds of questions.<br>
&gt; &gt; <br>
&gt; &gt; Julian<br>
&gt; &gt; <br>
&gt; &gt; --<br>
&gt; &gt; &lt;green/&gt;bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760<br>
&gt; &gt; <br>
&gt; &gt; <br>
&gt; <br>
&gt; <br>
</tt></font>
--=_alternative 000E026B85256D9B_=--



From w3c-dist-auth-request@w3.org  Mon Sep  8 09:50:36 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA19276
	for <webdav-archive@lists.ietf.org>; Mon, 8 Sep 2003 09:50:36 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 9753BA0532; Mon,  8 Sep 2003 09:50:40 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 06AD7A0532
	for <w3c-dist-auth@frink.w3.org>; Mon,  8 Sep 2003 09:50:38 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 93DB613AD4; Mon,  8 Sep 2003 09:41:48 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 2107613979
	for <w3c-dist-auth@w3c.org>; Mon,  8 Sep 2003 09:41:48 -0400 (EDT)
Received: (qmail 5377 invoked by uid 65534); 8 Sep 2003 13:41:47 -0000
Received: from unknown (HELO lisa) (217.5.201.10)
  by mail.gmx.net (mp009) with SMTP; 08 Sep 2003 15:41:47 +0200
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Geoffrey M Clemm" <geoffrey.clemm@us.ibm.com>, <w3c-dist-auth@w3c.org>
Date: Mon, 8 Sep 2003 15:41:45 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCOEFAIGAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
In-Reply-To: <OFF1E3105C.5C14F114-ON85256D9B.000DF33A-85256D9B.0042E846@us.ibm.com>
Subject: RE: getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCOEFAIGAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7865
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030908135040.9753BA0532@frink.w3.org>
Resent-Date: Mon,  8 Sep 2003 09:50:40 -0400 (EDT)
Content-Transfer-Encoding: 7bit


> From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]On
> Behalf Of Geoffrey M Clemm
> Sent: Monday, September 08, 2003 2:11 PM
> To: w3c-dist-auth@w3c.org
> Subject: RE: getlastmodified of collections
>
>
>
> I agree with Lisa's observations below, and my conclusion is that since
> the behavior of GET on a collection is not defined, the behavior of
> DAV:getlastmodified should not be defined, since the purpose
> of the Last-Modified header is to support caching of the GET request.

To clarify: the behaviour of GET and the HTTP Last-Modified header *is*
defined by RFC2616. A collection may or may not have gettable
representations (as any other resource), but if it does, the Last-Modified
header must obey RFC2616's rules (that is, if it's present it must change
when the GETtable content changes). The behaviour for DAV:getlastmodified
follows automatically.

> So until 2518 defines server-independent behavior of GET on a collection
> 2518 should remain silent on DAV:getlastmodified on a collection.

Yes. In particular, if we see a use case for a last modified timestamp that
is not directly tied to content changes, we need to define a new one. This
may be optional (as all the other timestamps we have), so it shouldn't be a
problem getting it into RFC2518bis.

Maybe a topic for the interop event?

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760



From w3c-dist-auth-request@w3.org  Mon Sep  8 09:58:33 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA20342
	for <webdav-archive@lists.ietf.org>; Mon, 8 Sep 2003 09:58:33 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 84A5CA07B1; Mon,  8 Sep 2003 09:58:36 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 1D6D1A07B1
	for <w3c-dist-auth@frink.w3.org>; Mon,  8 Sep 2003 09:58:34 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 38DDE13619; Mon,  8 Sep 2003 09:45:23 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 9E2121358C
	for <w3c-dist-auth@w3c.org>; Mon,  8 Sep 2003 09:45:22 -0400 (EDT)
Received: (qmail 11004 invoked by uid 65534); 8 Sep 2003 13:45:21 -0000
Received: from unknown (HELO lisa) (217.5.201.10)
  by mail.gmx.net (mp023) with SMTP; 08 Sep 2003 15:45:21 +0200
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Geoffrey M Clemm" <geoffrey.clemm@us.ibm.com>, <w3c-dist-auth@w3c.org>
Date: Mon, 8 Sep 2003 15:45:20 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCAEFCIGAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
In-Reply-To: <OFCC3AF710.B7939216-ON85256D9B.000B1A75-85256D9B.0042E587@us.ibm.com>
Subject: RE: DAV:getlastmodified of collections
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCAEFCIGAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7866
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030908135836.84A5CA07B1@frink.w3.org>
Resent-Date: Mon,  8 Sep 2003 09:58:36 -0400 (EDT)
Content-Transfer-Encoding: 7bit


> From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]On
> Behalf Of Geoffrey M Clemm
> Sent: Monday, September 08, 2003 2:11 PM
> To: w3c-dist-auth@w3c.org
> Subject: RE: DAV:getlastmodified of collections
>
>
>
> "Julian Reschke" <julian.reschke@gmx.de> wrote on 09/05/2003 06:08:11 PM:
> > But then we're missing the case of VERSION-CONTROL on a versionable but
> not
> > yet version-controlled resource that lives inside a versioned collection
> (in
> > which case I'd say the state of the parent collection *does* change).
>
> I suggest we keep the semantics very simple, and say that
DAV:getlastmodified
> is changed only by adding a binding, removing a binding, or changing a
binding
> to new resource.  Putting an existing resource under version control does
> none of these things, so it should not result in an update to
> DAV:getlastmodified.
>
> Note that in general the "version-controlled state" of a collection will
be
> different from the "state" of a collection, i.e. adding and removing a
binding
> to a non-version-controlled resource does not change the
version-controlled
> state of a collection, but does change the state of the collection.

This seems to imply that the version-controlled state is not a subset of the
state, or more precisely, that you can modify the version-controlled state
without changing the state. This IMHO seems to be a weird way to define the
state of a collection.

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760



From w3c-dist-auth-request@w3.org  Mon Sep  8 11:19:24 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29440
	for <webdav-archive@lists.ietf.org>; Mon, 8 Sep 2003 11:19:23 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id D61D7A0C20; Mon,  8 Sep 2003 11:19:18 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 689A1A101E
	for <w3c-dist-auth@frink.w3.org>; Mon,  8 Sep 2003 11:19:11 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 956A313617; Mon,  8 Sep 2003 11:18:40 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from e6.ny.us.ibm.com (e6.ny.us.ibm.com [32.97.182.106])
	by dr-nick.w3.org (Postfix) with ESMTP id 5C39913E59
	for <w3c-dist-auth@w3c.org>; Mon,  8 Sep 2003 11:18:39 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e6.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h88FIdWq693422
	for <w3c-dist-auth@w3c.org>; Mon, 8 Sep 2003 11:18:39 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h88FIbWo052278
	for <w3c-dist-auth@w3c.org>; Mon, 8 Sep 2003 11:18:37 -0400
In-Reply-To: <JIEGINCHMLABHJBIGKBCAEFCIGAA.julian.reschke@gmx.de>
To: w3c-dist-auth@w3c.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
Message-ID: <OF3BA57745.F717643E-ON85256D9B.00530FC8-85256D9B.00541CF7@us.ibm.com>
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Date: Mon, 8 Sep 2003 11:18:43 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/08/2003 11:18:37,
	Serialize complete at 09/08/2003 11:18:37
Content-Type: text/plain; charset="US-ASCII"
Subject: DAV:bindings-last-modified (was RE: DAV:getlastmodified of collections)
X-Archived-At: http://www.w3.org/mid/OF3BA57745.F717643E-ON85256D9B.00530FC8-85256D9B.00541CF7@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7867
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030908151918.D61D7A0C20@frink.w3.org>
Resent-Date: Mon,  8 Sep 2003 11:19:18 -0400 (EDT)


I believe that we have concluded that DAV:getlastmodified depends on
what the server returns on a GET on a collection, and therefore is not
something we can define (since what the server returns on a GET on a
collection is not defined).  So what we are really talking about in
this thread is a new property (which without much thought, I've named
DAV:bindings-last-modified).

This raises the key question: what will the client be using this new
property for.  I suggest it be used to keep the structure of a client
tree display synchronized with the names and resources on the server,
in which case the client doesn't care whether the version-controlled
state changes, as long as the named tree of resources is still valid.

Cheers,
Geoff

> > "Julian Reschke" <julian.reschke@gmx.de> wrote on 09/05/2003 06:08:11 
PM:
> > > But then we're missing the case of VERSION-CONTROL on a versionable 
but not
> > > yet version-controlled resource that lives inside a versioned 
collection (in
> > > which case I'd say the state of the parent collection *does* 
change).

> > Geoffrey M Clemm
> > I suggest we keep the semantics very simple, and say that 
DAV:getlastmodified
> > is changed only by adding a binding, removing a binding, or changing a 
binding
> > to new resource.  Putting an existing resource under version control 
does
> > none of these things, so it should not result in an update to
> > DAV:getlastmodified.
> >
> > Note that in general the "version-controlled state" of a collection 
will be
> > different from the "state" of a collection, i.e. adding and removing a 
binding
> > to a non-version-controlled resource does not change the 
version-controlled
> > state of a collection, but does change the state of the collection.
 
"Julian Reschke" <julian.reschke@gmx.de> wrote on 09/08/2003 09:45:20 AM:
> This seems to imply that the version-controlled state is not a subset of 
the
> state, or more precisely, that you can modify the version-controlled 
state
> without changing the state. This IMHO seems to be a weird way to define 
the
> state of a collection.




From w3c-dist-auth-request@w3.org  Mon Sep  8 11:44:58 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA00976
	for <webdav-archive@lists.ietf.org>; Mon, 8 Sep 2003 11:44:58 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 2CE7DA0753; Mon,  8 Sep 2003 11:44:20 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 41DB9A0753
	for <w3c-dist-auth@frink.w3.org>; Mon,  8 Sep 2003 11:44:17 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id F11E91360F; Mon,  8 Sep 2003 11:44:16 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from server8a.software-ag.de (server8a.software-ag.de [193.26.193.47])
	by dr-nick.w3.org (Postfix) with ESMTP id 21538135F8
	for <w3c-dist-auth@w3c.org>; Mon,  8 Sep 2003 11:44:16 -0400 (EDT)
Received: from daehub01.software-ag.de by server8a.software-ag.de; (8.11.6/8.9.3)
	id h88Fi3312407; Mon, 8 Sep 2003 17:44:14 +0200
Received: by daehub01.software-ag.de with Internet Mail Service (5.5.2653.19)
	id <RTLNANJM>; Mon, 8 Sep 2003 17:44:02 +0200
Message-ID: <DFF2AC9E3583D511A21F0008C7E6210605C48087@daemsg02.software-ag.de>
From: "Nevermann, Dr., Peter" <Peter.Nevermann@softwareag.com>
To: "'w3c-dist-auth@w3c.org'" <w3c-dist-auth@w3c.org>
Date: Mon, 8 Sep 2003 17:44:02 +0200 
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C37620.073CEC10"
Subject: RE: DAV:modificationdate (was bindings-last-modified (was RE: DAV 	:getlastmodified of collections))
X-Archived-At: http://www.w3.org/mid/DFF2AC9E3583D511A21F0008C7E6210605C48087@daemsg02.software-ag.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7868
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030908154420.2CE7DA0753@frink.w3.org>
Resent-Date: Mon,  8 Sep 2003 11:44:20 -0400 (EDT)


This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_001_01C37620.073CEC10
Content-Type: text/plain;
	charset="iso-8859-1"

I would prefer a more general new property, e.g. DAV:modificationdate as
proposed by Julian some days ago in another thread (I added a few words
about *bindings* of a collection to Julian's wording): 

    "A proper way to address this may be to define a new optional property 
    (if we make it optional, we may be able to get it into RFC52518bis), 
    for instance:

    Name:        modificationdate 
    Namespace:   DAV: 
    Purpose:     Records the time and date the resource was modified. 
    Value:       date-time   
    Description: The creationdate property should be defined on all DAV 
            compliant resources.  If present, it contains a timestamp 
            of the moment when the resource was last modified (i.e., the 
            moment when content and/or properties last changed,
            or, when the bindings of a collection last changed).
            This property is live and protected. The Internet date-time
            format is defined in [RFC3339], see the ABNF in section 5.6. 
    COPY/MOVE behavior: This property value SHOULD be kept during a 
            MOVE operation, but is re-initialized when a resource is 
            created with a COPY. It should not be set in a remote COPY. 
    
    <!ELEMENT modificationdate (#PCDATA) >"

Probably, w.r.t. properties, we need to clarify whether:
1) changes to *all* properties ought to be taken into account for setting
the modification date,
or only
2) changes to the *dead* properties plus some selected live properties (e.g.
non-protected properties).

I would go for 2).

Regards,
Peter 

> -----Original Message-----
> From: Geoffrey M Clemm [mailto:geoffrey.clemm@us.ibm.com]
> Sent: Monday, September 08, 2003 17:19
> To: w3c-dist-auth@w3c.org
> Subject: DAV:bindings-last-modified (was RE: DAV:getlastmodified of
> collections)
> 
> 
> 
> I believe that we have concluded that DAV:getlastmodified depends on
> what the server returns on a GET on a collection, and therefore is not
> something we can define (since what the server returns on a GET on a
> collection is not defined).  So what we are really talking about in
> this thread is a new property (which without much thought, I've named
> DAV:bindings-last-modified).
> 
> This raises the key question: what will the client be using this new
> property for.  I suggest it be used to keep the structure of a client
> tree display synchronized with the names and resources on the server,
> in which case the client doesn't care whether the version-controlled
> state changes, as long as the named tree of resources is still valid.
> 
> Cheers,
> Geoff
> 
> > > "Julian Reschke" <julian.reschke@gmx.de> wrote on 
> 09/05/2003 06:08:11 
> PM:
> > > > But then we're missing the case of VERSION-CONTROL on a 
> versionable 
> but not
> > > > yet version-controlled resource that lives inside a versioned 
> collection (in
> > > > which case I'd say the state of the parent collection *does* 
> change).
> 
> > > Geoffrey M Clemm
> > > I suggest we keep the semantics very simple, and say that 
> DAV:getlastmodified
> > > is changed only by adding a binding, removing a binding, 
> or changing a 
> binding
> > > to new resource.  Putting an existing resource under 
> version control 
> does
> > > none of these things, so it should not result in an update to
> > > DAV:getlastmodified.
> > >
> > > Note that in general the "version-controlled state" of a 
> collection 
> will be
> > > different from the "state" of a collection, i.e. adding 
> and removing a 
> binding
> > > to a non-version-controlled resource does not change the 
> version-controlled
> > > state of a collection, but does change the state of the 
> collection.
>  
> "Julian Reschke" <julian.reschke@gmx.de> wrote on 09/08/2003 
> 09:45:20 AM:
> > This seems to imply that the version-controlled state is 
> not a subset of 
> the
> > state, or more precisely, that you can modify the 
> version-controlled 
> state
> > without changing the state. This IMHO seems to be a weird 
> way to define 
> the
> > state of a collection.
> 
> 

------_=_NextPart_001_01C37620.073CEC10
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version =
5.5.2653.12">
<TITLE>RE: DAV:modificationdate (was bindings-last-modified (was RE: =
DAV:getlastmodified of collections))</TITLE>
</HEAD>
<BODY>

<P><FONT SIZE=3D2>I would prefer a more general new property, e.g. =
DAV:modificationdate as proposed by Julian some days ago in another =
thread (I added a few words about *bindings* of a collection to =
Julian's wording): </FONT></P>

<P><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; &quot;A proper way to address this =
may be to define a new optional property </FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; (if we make it optional, we may =
be able to get it into RFC52518bis), </FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; for instance:</FONT>
</P>

<P><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; =
Name:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; modificationdate =
</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; Namespace:&nbsp;&nbsp; DAV: =
</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; Purpose:&nbsp;&nbsp;&nbsp;&nbsp; =
Records the time and date the resource was modified. </FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; =
Value:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; date-time&nbsp;&nbsp; =
</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; Description: The creationdate =
property should be defined on all DAV </FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp; compliant resources.&nbsp; If present, it contains a timestamp =
</FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp; of the moment when the resource was last modified (i.e., the =
</FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp; moment when content and/or properties last changed,</FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp; or, when the bindings of a collection last changed).</FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp; This property is live and protected. The Internet date-time</FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp; format is defined in [RFC3339], see the ABNF in section 5.6. =
</FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; COPY/MOVE behavior: This property =
value SHOULD be kept during a </FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp; MOVE operation, but is re-initialized when a resource is </FONT>
<BR><FONT =
SIZE=3D2>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp; created with a COPY. It should not be set in a remote COPY. </FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; </FONT>
<BR><FONT SIZE=3D2>&nbsp;&nbsp;&nbsp; &lt;!ELEMENT modificationdate =
(#PCDATA) &gt;&quot;</FONT>
</P>

<P><FONT SIZE=3D2>Probably, w.r.t. properties, we need to clarify =
whether:</FONT>
<BR><FONT SIZE=3D2>1) changes to *all* properties ought to be taken =
into account for setting the modification date,</FONT>
<BR><FONT SIZE=3D2>or only</FONT>
<BR><FONT SIZE=3D2>2) changes to the *dead* properties plus some =
selected live properties (e.g. non-protected properties).</FONT>
</P>

<P><FONT SIZE=3D2>I would go for 2).</FONT>
</P>

<P><FONT SIZE=3D2>Regards,</FONT>
<BR><FONT SIZE=3D2>Peter </FONT>
</P>

<P><FONT SIZE=3D2>&gt; -----Original Message-----</FONT>
<BR><FONT SIZE=3D2>&gt; From: Geoffrey M Clemm [<A =
HREF=3D"mailto:geoffrey.clemm@us.ibm.com">mailto:geoffrey.clemm@us.ibm.c=
om</A>]</FONT>
<BR><FONT SIZE=3D2>&gt; Sent: Monday, September 08, 2003 17:19</FONT>
<BR><FONT SIZE=3D2>&gt; To: w3c-dist-auth@w3c.org</FONT>
<BR><FONT SIZE=3D2>&gt; Subject: DAV:bindings-last-modified (was RE: =
DAV:getlastmodified of</FONT>
<BR><FONT SIZE=3D2>&gt; collections)</FONT>
<BR><FONT SIZE=3D2>&gt; </FONT>
<BR><FONT SIZE=3D2>&gt; </FONT>
<BR><FONT SIZE=3D2>&gt; </FONT>
<BR><FONT SIZE=3D2>&gt; I believe that we have concluded that =
DAV:getlastmodified depends on</FONT>
<BR><FONT SIZE=3D2>&gt; what the server returns on a GET on a =
collection, and therefore is not</FONT>
<BR><FONT SIZE=3D2>&gt; something we can define (since what the server =
returns on a GET on a</FONT>
<BR><FONT SIZE=3D2>&gt; collection is not defined).&nbsp; So what we =
are really talking about in</FONT>
<BR><FONT SIZE=3D2>&gt; this thread is a new property (which without =
much thought, I've named</FONT>
<BR><FONT SIZE=3D2>&gt; DAV:bindings-last-modified).</FONT>
<BR><FONT SIZE=3D2>&gt; </FONT>
<BR><FONT SIZE=3D2>&gt; This raises the key question: what will the =
client be using this new</FONT>
<BR><FONT SIZE=3D2>&gt; property for.&nbsp; I suggest it be used to =
keep the structure of a client</FONT>
<BR><FONT SIZE=3D2>&gt; tree display synchronized with the names and =
resources on the server,</FONT>
<BR><FONT SIZE=3D2>&gt; in which case the client doesn't care whether =
the version-controlled</FONT>
<BR><FONT SIZE=3D2>&gt; state changes, as long as the named tree of =
resources is still valid.</FONT>
<BR><FONT SIZE=3D2>&gt; </FONT>
<BR><FONT SIZE=3D2>&gt; Cheers,</FONT>
<BR><FONT SIZE=3D2>&gt; Geoff</FONT>
<BR><FONT SIZE=3D2>&gt; </FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; &quot;Julian Reschke&quot; =
&lt;julian.reschke@gmx.de&gt; wrote on </FONT>
<BR><FONT SIZE=3D2>&gt; 09/05/2003 06:08:11 </FONT>
<BR><FONT SIZE=3D2>&gt; PM:</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; &gt; But then we're missing the case =
of VERSION-CONTROL on a </FONT>
<BR><FONT SIZE=3D2>&gt; versionable </FONT>
<BR><FONT SIZE=3D2>&gt; but not</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; &gt; yet version-controlled resource =
that lives inside a versioned </FONT>
<BR><FONT SIZE=3D2>&gt; collection (in</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; &gt; which case I'd say the state of =
the parent collection *does* </FONT>
<BR><FONT SIZE=3D2>&gt; change).</FONT>
<BR><FONT SIZE=3D2>&gt; </FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; Geoffrey M Clemm</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; I suggest we keep the semantics very =
simple, and say that </FONT>
<BR><FONT SIZE=3D2>&gt; DAV:getlastmodified</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; is changed only by adding a binding, =
removing a binding, </FONT>
<BR><FONT SIZE=3D2>&gt; or changing a </FONT>
<BR><FONT SIZE=3D2>&gt; binding</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; to new resource.&nbsp; Putting an =
existing resource under </FONT>
<BR><FONT SIZE=3D2>&gt; version control </FONT>
<BR><FONT SIZE=3D2>&gt; does</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; none of these things, so it should =
not result in an update to</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; DAV:getlastmodified.</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt;</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; Note that in general the =
&quot;version-controlled state&quot; of a </FONT>
<BR><FONT SIZE=3D2>&gt; collection </FONT>
<BR><FONT SIZE=3D2>&gt; will be</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; different from the &quot;state&quot; =
of a collection, i.e. adding </FONT>
<BR><FONT SIZE=3D2>&gt; and removing a </FONT>
<BR><FONT SIZE=3D2>&gt; binding</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; to a non-version-controlled resource =
does not change the </FONT>
<BR><FONT SIZE=3D2>&gt; version-controlled</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; &gt; state of a collection, but does =
change the state of the </FONT>
<BR><FONT SIZE=3D2>&gt; collection.</FONT>
<BR><FONT SIZE=3D2>&gt;&nbsp; </FONT>
<BR><FONT SIZE=3D2>&gt; &quot;Julian Reschke&quot; =
&lt;julian.reschke@gmx.de&gt; wrote on 09/08/2003 </FONT>
<BR><FONT SIZE=3D2>&gt; 09:45:20 AM:</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; This seems to imply that the =
version-controlled state is </FONT>
<BR><FONT SIZE=3D2>&gt; not a subset of </FONT>
<BR><FONT SIZE=3D2>&gt; the</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; state, or more precisely, that you can =
modify the </FONT>
<BR><FONT SIZE=3D2>&gt; version-controlled </FONT>
<BR><FONT SIZE=3D2>&gt; state</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; without changing the state. This IMHO =
seems to be a weird </FONT>
<BR><FONT SIZE=3D2>&gt; way to define </FONT>
<BR><FONT SIZE=3D2>&gt; the</FONT>
<BR><FONT SIZE=3D2>&gt; &gt; state of a collection.</FONT>
<BR><FONT SIZE=3D2>&gt; </FONT>
<BR><FONT SIZE=3D2>&gt; </FONT>
</P>

</BODY>
</HTML>
------_=_NextPart_001_01C37620.073CEC10--



From w3c-dist-auth-request@w3.org  Tue Sep  9 18:36:20 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA10004
	for <webdav-archive@lists.ietf.org>; Tue, 9 Sep 2003 18:36:20 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id D9F06A09CC; Tue,  9 Sep 2003 18:36:26 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id A54DEA0A6C
	for <w3c-dist-auth@frink.w3.org>; Tue,  9 Sep 2003 18:36:24 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 842C013700; Tue,  9 Sep 2003 18:36:24 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from gate.arc.nasa.gov (gate.arc.nasa.gov [128.102.102.51])
	by dr-nick.w3.org (Postfix) with ESMTP id 2C55613512
	for <w3c-dist-auth@w3c.org>; Tue,  9 Sep 2003 18:36:24 -0400 (EDT)
Received: from nasa.gov (moonstone.aen.nasa.gov [198.123.13.108])
	by gate.arc.nasa.gov ( -- Info omitted by ASANI Solutions, LLC.) with ESMTP id h89Ma4W25933;
	Tue, 9 Sep 2003 15:36:04 -0700 (PDT)
Message-ID: <3F5E55F1.4030403@nasa.gov>
Date: Tue, 09 Sep 2003 15:36:33 -0700
From: Chris Knight <Christopher.D.Knight@nasa.gov>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Cc: w3c-dist-auth@w3c.org
References: <OF3BA57745.F717643E-ON85256D9B.00530FC8-85256D9B.00541CF7@us.ibm.com>
In-Reply-To: <OF3BA57745.F717643E-ON85256D9B.00530FC8-85256D9B.00541CF7@us.ibm.com>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: DAV:bindings-last-modified (was RE: DAV:getlastmodified of collections)
X-Archived-At: http://www.w3.org/mid/3F5E55F1.4030403@nasa.gov
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7869
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030909223626.D9F06A09CC@frink.w3.org>
Resent-Date: Tue,  9 Sep 2003 18:36:26 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Geoffrey M Clemm wrote:

>I believe that we have concluded that DAV:getlastmodified depends on
>what the server returns on a GET on a collection, and therefore is not
>something we can define (since what the server returns on a GET on a
>collection is not defined).
>
Actually, since many servers do implement GET on a collection, how about 
saying "DAV:getlastmodified should be defined for collections if the 
server supports GET on collections and the value of the property would 
be the last time some operation changed what would be the result of a 
GET operation (and would be the value that would be compared against if 
a Last-Modified header was sent on said GET request)"?

Sorry, my brain is not thinking in protocol-spec-speak right now, but I 
think you get the idea.

Your other property for bindings would be useful as well, and I would 
guess that many implementations would make them equivalent (as a GET on 
a collection would return an HTML rendering of the bindings from that 
collection.)



From w3c-dist-auth-request@w3.org  Tue Sep  9 19:48:42 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA12955
	for <webdav-archive@lists.ietf.org>; Tue, 9 Sep 2003 19:48:41 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 3B700A0A0B; Tue,  9 Sep 2003 19:48:42 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id D6080A0A0B
	for <w3c-dist-auth@frink.w3.org>; Tue,  9 Sep 2003 19:48:35 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 31F5213BB2; Tue,  9 Sep 2003 19:39:21 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id F40C713B7C
	for <w3c-dist-auth@w3c.org>; Tue,  9 Sep 2003 19:39:20 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 19ws4t-0002cS-00; Tue, 09 Sep 2003 23:39:19 +0000
Received: from [192.168.1.151] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 19ws4t-0002cD-00; Tue, 09 Sep 2003 23:39:19 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: "'Chris Knight'" <Christopher.D.Knight@nasa.gov>,
        "'Geoffrey M Clemm'" <geoffrey.clemm@us.ibm.com>
Cc: <w3c-dist-auth@w3c.org>
Date: Tue, 9 Sep 2003 16:39:19 -0700
Message-ID: <006a01c3772b$96db9d60$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
Importance: Normal
In-reply-to: <3F5E55F1.4030403@nasa.gov>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Old-X-Envelope-To: Christopher.D.Knight@nasa.gov,
 geoffrey.clemm@us.ibm.com,
 w3c-dist-auth@w3c.org
Subject: RE: DAV:bindings-last-modified (was RE: DAV:getlastmodified of collections)
X-Archived-At: http://www.w3.org/mid/006a01c3772b$96db9d60$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7870
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030909234842.3B700A0A0B@frink.w3.org>
Resent-Date: Tue,  9 Sep 2003 19:48:42 -0400 (EDT)
Content-Transfer-Encoding: 7bit


This sounds like the right general idea.

I'm starting to think that RFC2518 needs a new section, a non-normative
note or warning on the dangers of relying on the value of 
'getlastmodified'.  As far as I can tell:
 - some servers allow this to be modified by clients
 - on a MOVE, some servers set the destination getlastmodified to
   the source's previous value, others set it to the timestamp of the
   operation itself
 - on a COPY, same thing, but probably not on all the same servers
   that do the MOVE that way
 - some servers allow underlying file system operations to replace
   files with new files with *older* getlastmodified values
 - some servers modify getlastmodifed when props change
 - the behavior on directories is probably completely random

Thus, clients can't rely on the value of getlastmodified (or
the Last-Modified header) at all and should use ETags instead.
If the server doesn't support ETags the client is screwed.  
In that case, possibly the only reasonable thing is to throw
away your cached version anytime the last modified value changes
an iota, even if it changes to be *earlier* than your cached 
version.

Lisa

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org 
> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Chris Knight
> Sent: Tuesday, September 09, 2003 3:37 PM
> To: Geoffrey M Clemm
> Cc: w3c-dist-auth@w3c.org
> Subject: Re: DAV:bindings-last-modified (was RE: 
> DAV:getlastmodified of collections)
> 
> 
> 
> Geoffrey M Clemm wrote:
> 
> >I believe that we have concluded that DAV:getlastmodified depends on 
> >what the server returns on a GET on a collection, and 
> therefore is not 
> >something we can define (since what the server returns on a GET on a 
> >collection is not defined).
> >
> Actually, since many servers do implement GET on a 
> collection, how about 
> saying "DAV:getlastmodified should be defined for collections if the 
> server supports GET on collections and the value of the 
> property would 
> be the last time some operation changed what would be the result of a 
> GET operation (and would be the value that would be compared 
> against if 
> a Last-Modified header was sent on said GET request)"?
> 
> Sorry, my brain is not thinking in protocol-spec-speak right 
> now, but I 
> think you get the idea.
> 
> Your other property for bindings would be useful as well, and I would 
> guess that many implementations would make them equivalent 
> (as a GET on 
> a collection would return an HTML rendering of the bindings from that 
> collection.)
> 
> 




From w3c-dist-auth-request@w3.org  Tue Sep  9 22:02:14 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA16672
	for <webdav-archive@lists.ietf.org>; Tue, 9 Sep 2003 22:02:13 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 9A531A0553; Tue,  9 Sep 2003 22:02:19 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id EA4D0A0BCD
	for <w3c-dist-auth@frink.w3.org>; Tue,  9 Sep 2003 22:02:16 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 9B245137C1; Tue,  9 Sep 2003 22:02:16 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from e5.ny.us.ibm.com (e5.ny.us.ibm.com [32.97.182.105])
	by dr-nick.w3.org (Postfix) with ESMTP id 7FC4B1334C
	for <w3c-dist-auth@w3c.org>; Tue,  9 Sep 2003 22:02:16 -0400 (EDT)
Received: from northrelay02.pok.ibm.com (northrelay02.pok.ibm.com [9.56.224.150])
	by e5.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h8A22G0H759502
	for <w3c-dist-auth@w3c.org>; Tue, 9 Sep 2003 22:02:16 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay02.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h8A22FYT229590
	for <w3c-dist-auth@w3c.org>; Tue, 9 Sep 2003 22:02:15 -0400
In-Reply-To: <006a01c3772b$96db9d60$f8cb90c6@lisalap>
To: w3c-dist-auth@w3c.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Message-ID: <OF20BE7008.938E407D-ON85256D9D.0009C2F3-85256D9D.000B2FF5@us.ibm.com>
Date: Tue, 9 Sep 2003 22:02:11 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/09/2003 22:02:15,
	Serialize complete at 09/09/2003 22:02:15
Content-Type: multipart/alternative; boundary="=_alternative 000A222B85256D9D_="
Subject: RE: DAV:bindings-last-modified (was RE: DAV:getlastmodified of collections)
X-Archived-At: http://www.w3.org/mid/OF20BE7008.938E407D-ON85256D9D.0009C2F3-85256D9D.000B2FF5@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7871
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030910020219.9A531A0553@frink.w3.org>
Resent-Date: Tue,  9 Sep 2003 22:02:19 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 000A222B85256D9D_=
Content-Type: text/plain; charset="US-ASCII"

I agree with Lisa's points below, especially the last point, i.e.
that we should provide guidance to clients that they should always
check for equality of the Last-Modified value to what they
previously retrieved.

Cheers,
Geoff

"Lisa Dusseault" <lisa@xythos.com> wrote on 09/09/2003 07:39:19 PM:

> This sounds like the right general idea.
> 
> I'm starting to think that RFC2518 needs a new section, a non-normative
> note or warning on the dangers of relying on the value of 
> 'getlastmodified'.  As far as I can tell:
>  - some servers allow this to be modified by clients
>  - on a MOVE, some servers set the destination getlastmodified to
>    the source's previous value, others set it to the timestamp of the
>    operation itself
>  - on a COPY, same thing, but probably not on all the same servers
>    that do the MOVE that way
>  - some servers allow underlying file system operations to replace
>    files with new files with *older* getlastmodified values
>  - some servers modify getlastmodifed when props change
>  - the behavior on directories is probably completely random
> 
> Thus, clients can't rely on the value of getlastmodified (or
> the Last-Modified header) at all and should use ETags instead.
> If the server doesn't support ETags the client is screwed. 
> In that case, possibly the only reasonable thing is to throw
> away your cached version anytime the last modified value changes
> an iota, even if it changes to be *earlier* than your cached 
> version.
> 
> Lisa
> 

--=_alternative 000A222B85256D9D_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2><tt>I agree with Lisa's points below, especially the last
point, i.e.</tt></font>
<br><font size=2><tt>that we should provide guidance to clients that they
should always</tt></font>
<br><font size=2><tt>check for equality of the Last-Modified value to what
they</tt></font>
<br><font size=2><tt>previously retrieved.</tt></font>
<br>
<br><font size=2><tt>Cheers,</tt></font>
<br><font size=2><tt>Geoff</tt></font>
<br>
<br><font size=2><tt>&quot;Lisa Dusseault&quot; &lt;lisa@xythos.com&gt;
wrote on 09/09/2003 07:39:19 PM:<br>
<br>
&gt; This sounds like the right general idea.<br>
&gt; <br>
&gt; I'm starting to think that RFC2518 needs a new section, a non-normative<br>
&gt; note or warning on the dangers of relying on the value of <br>
&gt; 'getlastmodified'. &nbsp;As far as I can tell:<br>
&gt; &nbsp;- some servers allow this to be modified by clients<br>
&gt; &nbsp;- on a MOVE, some servers set the destination getlastmodified
to<br>
&gt; &nbsp; &nbsp;the source's previous value, others set it to the timestamp
of the<br>
&gt; &nbsp; &nbsp;operation itself<br>
&gt; &nbsp;- on a COPY, same thing, but probably not on all the same servers<br>
&gt; &nbsp; &nbsp;that do the MOVE that way<br>
&gt; &nbsp;- some servers allow underlying file system operations to replace<br>
&gt; &nbsp; &nbsp;files with new files with *older* getlastmodified values<br>
&gt; &nbsp;- some servers modify getlastmodifed when props change<br>
&gt; &nbsp;- the behavior on directories is probably completely random<br>
&gt; <br>
&gt; Thus, clients can't rely on the value of getlastmodified (or<br>
&gt; the Last-Modified header) at all and should use ETags instead.<br>
&gt; If the server doesn't support ETags the client is screwed. &nbsp;<br>
&gt; In that case, possibly the only reasonable thing is to throw<br>
&gt; away your cached version anytime the last modified value changes<br>
&gt; an iota, even if it changes to be *earlier* than your cached <br>
&gt; version.<br>
&gt; <br>
&gt; Lisa<br>
&gt; <br>
</tt></font>
--=_alternative 000A222B85256D9D_=--



From w3c-dist-auth-request@w3.org  Tue Sep  9 22:02:27 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA16727
	for <webdav-archive@lists.ietf.org>; Tue, 9 Sep 2003 22:02:27 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 4C869A08F4; Tue,  9 Sep 2003 22:02:22 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id D3BCCA08F4
	for <w3c-dist-auth@frink.w3.org>; Tue,  9 Sep 2003 22:02:19 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 822AB13A20; Tue,  9 Sep 2003 22:02:19 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from e6.ny.us.ibm.com (e6.ny.us.ibm.com [32.97.182.106])
	by dr-nick.w3.org (Postfix) with ESMTP id 6D28D13A02
	for <w3c-dist-auth@w3c.org>; Tue,  9 Sep 2003 22:02:19 -0400 (EDT)
Received: from northrelay02.pok.ibm.com (northrelay02.pok.ibm.com [9.56.224.150])
	by e6.ny.us.ibm.com (8.12.9/8.12.2) with ESMTP id h8A22JWq305590
	for <w3c-dist-auth@w3c.org>; Tue, 9 Sep 2003 22:02:19 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay02.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h8A22IYT229600
	for <w3c-dist-auth@w3c.org>; Tue, 9 Sep 2003 22:02:18 -0400
In-Reply-To: <3F5E55F1.4030403@nasa.gov>
To: w3c-dist-auth@w3c.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Message-ID: <OFCB70AE58.A8C51C89-ON85256D9D.000A2FD6-85256D9D.000B30F7@us.ibm.com>
Date: Tue, 9 Sep 2003 22:02:14 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/09/2003 22:02:18,
	Serialize complete at 09/09/2003 22:02:18
Content-Type: multipart/alternative; boundary="=_alternative 000A65A585256D9D_="
Subject: Re: DAV:bindings-last-modified (was RE: DAV:getlastmodified of collections)
X-Archived-At: http://www.w3.org/mid/OFCB70AE58.A8C51C89-ON85256D9D.000A2FD6-85256D9D.000B30F7@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7872
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030910020222.4C869A08F4@frink.w3.org>
Resent-Date: Tue,  9 Sep 2003 22:02:22 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 000A65A585256D9D_=
Content-Type: text/plain; charset="US-ASCII"

If one were to add language of the kind you describe below, I'd emphasize
that this is just implied by the definition of the Last-Modified header,
and not some new semantics defined for collections.

Cheers,
Geoff

Chris Knight <Christopher.D.Knight@nasa.gov> wrote on 09/09/2003 06:36:33 
PM:

> Geoffrey M Clemm wrote:
> 
> >I believe that we have concluded that DAV:getlastmodified depends on
> >what the server returns on a GET on a collection, and therefore is not
> >something we can define (since what the server returns on a GET on a
> >collection is not defined).
> >
> Actually, since many servers do implement GET on a collection, how about 

> saying "DAV:getlastmodified should be defined for collections if the 
> server supports GET on collections and the value of the property would 
> be the last time some operation changed what would be the result of a 
> GET operation (and would be the value that would be compared against if 
> a Last-Modified header was sent on said GET request)"?
> 
> Sorry, my brain is not thinking in protocol-spec-speak right now, but I 
> think you get the idea.
> 
> Your other property for bindings would be useful as well, and I would 
> guess that many implementations would make them equivalent (as a GET on 
> a collection would return an HTML rendering of the bindings from that 
> collection.)
> 

--=_alternative 000A65A585256D9D_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2><tt>If one were to add language of the kind you describe
below, I'd emphasize</tt></font>
<br><font size=2><tt>that this is just implied by the definition of the
Last-Modified header,</tt></font>
<br><font size=2><tt>and not some new semantics defined for collections.</tt></font>
<br><font size=2><tt><br>
Cheers,</tt></font>
<br><font size=2><tt>Geoff</tt></font>
<br>
<br><font size=2><tt>Chris Knight &lt;Christopher.D.Knight@nasa.gov&gt;
wrote on 09/09/2003 06:36:33 PM:<br>
<br>
&gt; Geoffrey M Clemm wrote:<br>
&gt; <br>
&gt; &gt;I believe that we have concluded that DAV:getlastmodified depends
on<br>
&gt; &gt;what the server returns on a GET on a collection, and therefore
is not<br>
&gt; &gt;something we can define (since what the server returns on a GET
on a<br>
&gt; &gt;collection is not defined).<br>
&gt; &gt;<br>
&gt; Actually, since many servers do implement GET on a collection, how
about <br>
&gt; saying &quot;DAV:getlastmodified should be defined for collections
if the <br>
&gt; server supports GET on collections and the value of the property would
<br>
&gt; be the last time some operation changed what would be the result of
a <br>
&gt; GET operation (and would be the value that would be compared against
if <br>
&gt; a Last-Modified header was sent on said GET request)&quot;?<br>
&gt; <br>
&gt; Sorry, my brain is not thinking in protocol-spec-speak right now,
but I <br>
&gt; think you get the idea.<br>
&gt; <br>
&gt; Your other property for bindings would be useful as well, and I would
<br>
&gt; guess that many implementations would make them equivalent (as a GET
on <br>
&gt; a collection would return an HTML rendering of the bindings from that
<br>
&gt; collection.)<br>
&gt; <br>
</tt></font>
--=_alternative 000A65A585256D9D_=--



From w3c-dist-auth-request@w3.org  Thu Sep 11 09:18:51 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA21582
	for <webdav-archive@lists.ietf.org>; Thu, 11 Sep 2003 09:18:50 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 2C2CCA05AE; Thu, 11 Sep 2003 09:18:55 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 257C8A0643
	for <w3c-dist-auth@frink.w3.org>; Thu, 11 Sep 2003 09:18:51 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id B0A9C13822; Thu, 11 Sep 2003 09:18:50 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by dr-nick.w3.org (Postfix) with ESMTP id 7D0D013A80
	for <w3c-dist-auth@w3.org>; Thu, 11 Sep 2003 09:18:50 -0400 (EDT)
Received: from CNRI.Reston.VA.US (localhost [127.0.0.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA21571;
	Thu, 11 Sep 2003 09:18:45 -0400 (EDT)
Message-Id: <200309111318.JAA21571@ietf.org>
Mime-Version: 1.0
Content-Type: Multipart/Mixed; Boundary="NextPart"
To: IETF-Announce: ;
Cc: w3c-dist-auth@w3.org
From: Internet-Drafts@ietf.org
Reply-To: Internet-Drafts@ietf.org
Date: Thu, 11 Sep 2003 09:18:45 -0400
Subject: I-D ACTION:draft-ietf-webdav-redirectref-protocol-04.txt
X-Archived-At: http://www.w3.org/mid/200309111318.JAA21571@ietf.org
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7873
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030911131855.2C2CCA05AE@frink.w3.org>
Resent-Date: Thu, 11 Sep 2003 09:18:55 -0400 (EDT)


--NextPart

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the WWW Distributed Authoring and Versioning Working Group of the IETF.

	Title		: WebDAV Redirect Reference Resources
	Author(s)	: J. Slein, et. al.
	Filename	: draft-ietf-webdav-redirectref-protocol-04.txt
	Pages		: 66
	Date		: 2003-9-10
	
This is one of a pair of specifications that extend the WebDAV 
Distributed Authoring Protocol to enable clients to create new access
paths to existing resources.  The two protocol extensions have very
different characteristics that make them useful for different sorts
of applications.

The present specification defines redirect reference resources.  A
redirect reference resource is a resource whose default response is
an HTTP/1.1 302 (Found) status code, redirecting the client to a
different resource, the target resource.  A redirect reference makes
it possible to access the target resource indirectly, through any URI
mapped to the redirect reference resource.  There are no integrity
guarantees associated with redirect reference resources.

The related specification [B], defines bindings, and the BIND method
for creating them.  Creating a new binding to a resource indirectly
creates one or more new URIs mapped to that resource, which can then
be used to access it.  Servers are required to insure the integrity
of any bindings that they allow to be created.

Distribution of this document is unlimited. Please send comments to
the Distributed Authoring and Versioning (WebDAV) working group at
w3c-dist-auth@w3.org [1], which may be joined by sending a message
with subject 'subscribe' to w3c-dist-auth-request@w3.org [2].

Discussions of the WEBDAV working group are archived at URL: http://lists.w3.org/Archives/Public/w3c-dist-auth/.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-webdav-redirectref-protocol-04.txt

To remove yourself from the IETF Announcement list, send a message to 
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-webdav-redirectref-protocol-04.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt


Internet-Drafts can also be obtained by e-mail.

Send a message to:
	mailserv@ietf.org.
In the body type:
	"FILE /internet-drafts/draft-ietf-webdav-redirectref-protocol-04.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.
		
		
Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--NextPart
Content-Type: Multipart/Alternative; Boundary="OtherAccess"

--OtherAccess
Content-Type: Message/External-body;
	access-type="mail-server";
	server="mailserv@ietf.org"

Content-Type: text/plain
Content-ID:	<2003-9-10135156.I-D@ietf.org>

ENCODING mime
FILE /internet-drafts/draft-ietf-webdav-redirectref-protocol-04.txt

--OtherAccess
Content-Type: Message/External-body;
	name="draft-ietf-webdav-redirectref-protocol-04.txt";
	site="ftp.ietf.org";
	access-type="anon-ftp";
	directory="internet-drafts"

Content-Type: text/plain
Content-ID:	<2003-9-10135156.I-D@ietf.org>

--OtherAccess--

--NextPart--




From w3c-dist-auth-request@w3.org  Fri Sep 12 04:06:16 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA12616
	for <webdav-archive@lists.ietf.org>; Fri, 12 Sep 2003 04:06:16 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 492DDA068F; Fri, 12 Sep 2003 04:06:22 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 6518CA068F
	for <w3c-dist-auth@frink.w3.org>; Fri, 12 Sep 2003 04:06:19 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 4995113D0B; Fri, 12 Sep 2003 04:03:31 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (pop.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id D34F013D05
	for <w3c-dist-auth@w3.org>; Fri, 12 Sep 2003 04:03:30 -0400 (EDT)
Received: (qmail 28399 invoked by uid 65534); 12 Sep 2003 08:03:29 -0000
Received: from p3EE24811.dip.t-dialin.net (HELO lisa) (62.226.72.17)
  by mail.gmx.net (mp023) with SMTP; 12 Sep 2003 10:03:29 +0200
From: "Julian Reschke" <julian.reschke@gmx.de>
To: <w3c-dist-auth@w3.org>
Date: Fri, 12 Sep 2003 10:03:12 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCIECDIHAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
In-Reply-To: <200309111318.JAA21571@ietf.org>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
Subject: RE: I-D ACTION:draft-ietf-webdav-redirectref-protocol-04.txt
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCIECDIHAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7874
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030912080622.492DDA068F@frink.w3.org>
Resent-Date: Fri, 12 Sep 2003 04:06:22 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Hi.

One note regarding the draft progress: I'm still resolving editorial issues
raised during the "last call" in 2000. This draft hasn't got the
dependencies on the BIND spec anymore. The next steps will be

- to clarify that redirect refs do not have (authorable) content, and
- to replace MKRESOURCE by a more specific method.

Regards,

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of
> Internet-Drafts@ietf.org
> Sent: Thursday, September 11, 2003 3:19 PM
> To: IETF-Announce:
> Cc: w3c-dist-auth@w3.org
> Subject: I-D ACTION:draft-ietf-webdav-redirectref-protocol-04.txt
>
>
> A New Internet-Draft is available from the on-line
> Internet-Drafts directories.
> This draft is a work item of the WWW Distributed Authoring and
> Versioning Working Group of the IETF.
>
> 	Title		: WebDAV Redirect Reference Resources
> 	Author(s)	: J. Slein, et. al.
> 	Filename	: draft-ietf-webdav-redirectref-protocol-04.txt
> 	Pages		: 66
> 	Date		: 2003-9-10
>
> This is one of a pair of specifications that extend the WebDAV
> Distributed Authoring Protocol to enable clients to create new access
> paths to existing resources.  The two protocol extensions have very
> different characteristics that make them useful for different sorts
> of applications.
>
> The present specification defines redirect reference resources.  A
> redirect reference resource is a resource whose default response is
> an HTTP/1.1 302 (Found) status code, redirecting the client to a
> different resource, the target resource.  A redirect reference makes
> it possible to access the target resource indirectly, through any URI
> mapped to the redirect reference resource.  There are no integrity
> guarantees associated with redirect reference resources.
>
> The related specification [B], defines bindings, and the BIND method
> for creating them.  Creating a new binding to a resource indirectly
> creates one or more new URIs mapped to that resource, which can then
> be used to access it.  Servers are required to insure the integrity
> of any bindings that they allow to be created.
>
> Distribution of this document is unlimited. Please send comments to
> the Distributed Authoring and Versioning (WebDAV) working group at
> w3c-dist-auth@w3.org [1], which may be joined by sending a message
> with subject 'subscribe' to w3c-dist-auth-request@w3.org [2].
>
> Discussions of the WEBDAV working group are archived at URL:
http://lists.w3.org/Archives/Public/w3c-dist-auth/.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-webdav-redirectref-protocol-0
4.txt

To remove yourself from the IETF Announcement list, send a message to
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-webdav-redirectref-protocol-04.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt


Internet-Drafts can also be obtained by e-mail.

Send a message to:
	mailserv@ietf.org.
In the body type:
	"FILE /internet-drafts/draft-ietf-webdav-redirectref-protocol-04.txt".

NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.


Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.



From w3c-dist-auth-request@w3.org  Tue Sep 16 10:55:46 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA19648
	for <webdav-archive@lists.ietf.org>; Tue, 16 Sep 2003 10:55:44 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 5A2A6A096C; Tue, 16 Sep 2003 10:55:50 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 3CD92A0A9A
	for <w3c-dist-auth@frink.w3.org>; Tue, 16 Sep 2003 10:55:48 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id EF0C913914; Tue, 16 Sep 2003 10:55:47 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.opentext.se (unknown [213.136.51.2])
	by dr-nick.w3.org (Postfix) with ESMTP id 6ED92136B4
	for <w3c-dist-auth@w3.org>; Tue, 16 Sep 2003 10:55:47 -0400 (EDT)
Message-id: <fc.001e85b500da675b001e85b500da675b.da68f6@agora.se>
Date: Tue, 16 Sep 2003 17:01:55 +0200
To: w3c-dist-auth@w3.org
From: "Sofia =?ISO-8859-1?Q?Sundstr=F6m?=" <sofia.sundstrom@centrinity.se>
MIME-Version: 1.0
Content-type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Subject: connecting to webdav server from web page
X-Archived-At: http://www.w3.org/mid/fc.001e85b500da675b001e85b500da675b.da68f6@agora.se
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7875
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030916145550.5A2A6A096C@frink.w3.org>
Resent-Date: Tue, 16 Sep 2003 10:55:50 -0400 (EDT)
Content-Transfer-Encoding: 8bit


Hi, 

I am working on a web site where users need to be able to upload and
download files using WebDav. WebDav applications like Web Files and
Goliath seem rather easy to use, but the problem is that the people
who will log into my website are not very technically oriented (or
lazy, whatever you prefer). Therefore I have been trying to find a
way to connect to a server using WebDav, without the users having to
make any effort, like downloading a client (e.g. Goliath) or having
to fill in a URL in the Network connection setup.

Since the user will enter login details when they login to the site I
guess it would be possible to automatically use the same login
details when connecting to the server (and setup the server accounts
in accordance). Is there any way that the user could just click a
button on the web site to connect to the server and to open a window
where the user will be able to upload and download files by dragging
and dropping? (This needs to work on both Mac and Windows.)

I have been searching the web like crazy to find an answer, but I
haven't found any help. I hope there is someone on this list who can
help me!

Thanks,
Sofia



From w3c-dist-auth-request@w3.org  Wed Sep 17 13:07:55 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA20373
	for <webdav-archive@lists.ietf.org>; Wed, 17 Sep 2003 13:07:55 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 8268BA0515; Wed, 17 Sep 2003 13:08:03 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 73D76A0515
	for <w3c-dist-auth@frink.w3.org>; Wed, 17 Sep 2003 13:08:01 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 1D9BF133D4; Wed, 17 Sep 2003 13:08:01 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mucmx02.ixos.de (HOST.31.93.ixos.de [149.235.31.93])
	by dr-nick.w3.org (Postfix) with ESMTP id 8A174133B9
	for <w3c-dist-auth@w3.org>; Wed, 17 Sep 2003 13:08:00 -0400 (EDT)
Received: from MUCXG02.ixos.de (localhost [127.0.0.1])
	by mucmx02.ixos.de (8.12.9/8.12.9) with ESMTP id h8HH7wOJ025138
	for <w3c-dist-auth@w3.org>; Wed, 17 Sep 2003 19:07:58 +0200 (MEST)
Received: by MUCXG02.ixos.de with Internet Mail Service (5.5.2653.19)
	id <Q5Y60BRN>; Wed, 17 Sep 2003 19:08:14 +0200
Message-ID: <077097E85A6BD3119E910800062786A905121F5E@muc-mail5.ixos.de>
From: Horst Liermann <horst.liermann@ixos.de>
To: "'w3c-dist-auth@w3.org'" <w3c-dist-auth@w3.org>
Date: Wed, 17 Sep 2003 19:08:07 +0200
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
Subject: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/077097E85A6BD3119E910800062786A905121F5E@muc-mail5.ixos.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7876
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030917170803.8268BA0515@frink.w3.org>
Resent-Date: Wed, 17 Sep 2003 13:08:03 -0400 (EDT)


Hi all,

some questions about lockdiscovery and ACL's

Suppose, you have a server with WebDAV ( including lock) and it support's
ACL. What is the behavior for lockdiscovery, can I see all lock token or am
I only allowed to see the tokens where I am the owner of the lock ? As far
as I understand, lockdiscovery reports all locks. Is this a security leak ?

Best Regards
   Horst



From w3c-dist-auth-request@w3.org  Wed Sep 17 14:17:00 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA22459
	for <webdav-archive@lists.ietf.org>; Wed, 17 Sep 2003 14:17:00 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 3E638A051D; Wed, 17 Sep 2003 14:17:07 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 03F0CA051D
	for <w3c-dist-auth@frink.w3.org>; Wed, 17 Sep 2003 14:17:04 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 8EF5F13C9D; Wed, 17 Sep 2003 14:17:03 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from inet-mail4.oracle.com (inet-mail4.oracle.com [148.87.2.204])
	by dr-nick.w3.org (Postfix) with ESMTP id 3EE5F1375F
	for <w3c-dist-auth@w3.org>; Wed, 17 Sep 2003 14:17:03 -0400 (EDT)
Received: from rgmgw6.us.oracle.com (rgmgw6.us.oracle.com [138.1.191.15])
	by inet-mail4.oracle.com (Switch-3.1.0/Switch-3.1.0) with ESMTP id h8HIGxs7001289;
	Wed, 17 Sep 2003 11:17:00 -0700 (PDT)
Received: from rgmgw6.us.oracle.com (localhost [127.0.0.1])
	by rgmgw6.us.oracle.com (Switch-2.1.5/Switch-2.1.0) with ESMTP id h8HIGw214610;
	Wed, 17 Sep 2003 12:16:59 -0600 (MDT)
Received: from esedlar (dhcp-amer-vpn-gw2-west-141-144-76-138.vpn.oracle.com [141.144.76.138])
	by rgmgw6.us.oracle.com (Switch-2.1.5/Switch-2.1.0) with ESMTP id h8HIGr214383;
	Wed, 17 Sep 2003 12:16:53 -0600 (MDT)
Message-Id: <200309171816.h8HIGr214383@rgmgw6.us.oracle.com>
From: "Eric Sedlar" <eric.sedlar@oracle.com>
To: "'Horst Liermann'" <horst.liermann@ixos.de>, <w3c-dist-auth@w3.org>
Date: Wed, 17 Sep 2003 11:16:33 -0700
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Microsoft Outlook, Build 11.0.4920
In-Reply-To: <077097E85A6BD3119E910800062786A905121F5E@muc-mail5.ixos.de>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Thread-Index: AcN9Ple9BL84agi2QzaoQuT8sNOiGQACSxHw
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/200309171816.h8HIGr214383@rgmgw6.us.oracle.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7877
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030917181707.3E638A051D@frink.w3.org>
Resent-Date: Wed, 17 Sep 2003 14:17:07 -0400 (EDT)
Content-Transfer-Encoding: quoted-printable


The ACL spec hasn't defined a privilege specifically to control read =
access
to the lockdiscovery property, or even a privilege to control access to =
all
the privileges in total.  An individual server implementation could =
provide
such a privilege and aggregate it under <dav:read>, but this isn't =
required.

--Eric

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org =
[mailto:w3c-dist-auth-request@w3.org]
> On Behalf Of Horst Liermann
> Sent: Wednesday, September 17, 2003 10:08 AM
> To: 'w3c-dist-auth@w3.org'
>=20
>=20
> Hi all,
>=20
> some questions about lockdiscovery and ACL's
>=20
> Suppose, you have a server with WebDAV ( including lock) and it =
support's
> ACL. What is the behavior for lockdiscovery, can I see all lock token =
or
> am
> I only allowed to see the tokens where I am the owner of the lock ? As =
far
> as I understand, lockdiscovery reports all locks. Is this a security =
leak
> ?
>=20
> Best Regards
>    Horst




From w3c-dist-auth-request@w3.org  Wed Sep 17 19:49:25 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA06176
	for <webdav-archive@lists.ietf.org>; Wed, 17 Sep 2003 19:49:25 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 6F7A7A084A; Wed, 17 Sep 2003 19:49:31 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id C4A13A0918
	for <w3c-dist-auth@frink.w3.org>; Wed, 17 Sep 2003 19:49:28 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 8947313900; Wed, 17 Sep 2003 19:49:28 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id 3D745134CF
	for <w3c-dist-auth@w3.org>; Wed, 17 Sep 2003 19:49:28 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 19zm2s-0006Ow-00; Wed, 17 Sep 2003 23:49:14 +0000
Received: from [198.144.203.248] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 19zm2s-0006Od-00; Wed, 17 Sep 2003 23:49:14 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: "'Eric Sedlar'" <eric.sedlar@oracle.com>,
        "'Horst Liermann'" <horst.liermann@ixos.de>, <w3c-dist-auth@w3.org>
Date: Wed, 17 Sep 2003 16:49:20 -0700
Message-ID: <008b01c37d76$5106f810$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
Importance: Normal
In-Reply-To: <200309171816.h8HIGr214383@rgmgw6.us.oracle.com>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Old-X-Envelope-To: eric.sedlar@oracle.com,
 horst.liermann@ixos.de,
 w3c-dist-auth@w3.org
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/008b01c37d76$5106f810$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7878
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030917234931.6F7A7A084A@frink.w3.org>
Resent-Date: Wed, 17 Sep 2003 19:49:31 -0400 (EDT)
Content-Transfer-Encoding: 7bit


I'd also point out that the lockdiscovery property MUST contain
all the lock tokens, regardless of access control settings.  This
is not considered a security leak, because authorization is also
needed to use a lock token.  So this is the server logic to apply
whenever the client provides a lock token: 

Is this the same authorization context that took out the lock? 
  Yes {
	Allow the operation normally, provided the operation is 
	allowed, and provided the lock token is correct and all
	required lock tokens are provided, etc.
  } No {
	Is this an UNLOCK operation, with an authorization that
	includes permission to delete others' locks?
	Yes {
		perform UNLOCK
	} No {
		Fail request
	}
  }

Lisa

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org 
> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> Sent: Wednesday, September 17, 2003 11:17 AM
> To: 'Horst Liermann'; w3c-dist-auth@w3.org
> Subject: RE: ACL and lockdiscovery
> 
> 
> 
> The ACL spec hasn't defined a privilege specifically to 
> control read access to the lockdiscovery property, or even a 
> privilege to control access to all the privileges in total.  
> An individual server implementation could provide such a 
> privilege and aggregate it under <dav:read>, but this isn't required.
> 
> --Eric
> 
> > -----Original Message-----
> > From: w3c-dist-auth-request@w3.org 
> > [mailto:w3c-dist-auth-request@w3.org]
> > On Behalf Of Horst Liermann
> > Sent: Wednesday, September 17, 2003 10:08 AM
> > To: 'w3c-dist-auth@w3.org'
> > 
> > 
> > Hi all,
> > 
> > some questions about lockdiscovery and ACL's
> > 
> > Suppose, you have a server with WebDAV ( including lock) and it 
> > support's ACL. What is the behavior for lockdiscovery, can 
> I see all 
> > lock token or am I only allowed to see the tokens where I 
> am the owner 
> > of the lock ? As far as I understand, lockdiscovery reports 
> all locks. 
> > Is this a security leak ?
> > 
> > Best Regards
> >    Horst
> 
> 
> 




From w3c-dist-auth-request@w3.org  Thu Sep 18 09:57:24 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11912
	for <webdav-archive@lists.ietf.org>; Thu, 18 Sep 2003 09:57:23 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 7956CA057E; Thu, 18 Sep 2003 09:57:29 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 6E454A057E
	for <w3c-dist-auth@frink.w3.org>; Thu, 18 Sep 2003 09:57:25 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 2662613BC4; Thu, 18 Sep 2003 09:57:25 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by dr-nick.w3.org (Postfix) with ESMTP id 3C8A613BB1
	for <w3c-dist-auth@w3.org>; Thu, 18 Sep 2003 09:57:24 -0400 (EDT)
Received: from CNRI.Reston.VA.US (localhost [127.0.0.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11884;
	Thu, 18 Sep 2003 09:57:16 -0400 (EDT)
Message-Id: <200309181357.JAA11884@ietf.org>
Mime-Version: 1.0
Content-Type: Multipart/Mixed; Boundary="NextPart"
To: IETF-Announce: ;
Cc: w3c-dist-auth@w3.org
From: Internet-Drafts@ietf.org
Reply-To: Internet-Drafts@ietf.org
Date: Thu, 18 Sep 2003 09:57:16 -0400
Subject: I-D ACTION:draft-ietf-webdav-acl-11.txt
X-Archived-At: http://www.w3.org/mid/200309181357.JAA11884@ietf.org
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7879
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030918135729.7956CA057E@frink.w3.org>
Resent-Date: Thu, 18 Sep 2003 09:57:29 -0400 (EDT)


--NextPart

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the WWW Distributed Authoring and Versioning Working Group of the IETF.

	Title		: WebDAV Access Control Protocol
	Author(s)	: G. Clemm et al.
	Filename	: draft-ietf-webdav-acl-11.txt
	Pages		: 59
	Date		: 2003-9-18
	
This document specifies a set of methods, headers, message bodies, 
properties, and reports that define Access Control extensions to the 
WebDAV Distributed Authoring Protocol. This protocol permits a client 
to read and modify access control lists that instruct a server whether 
to allow or deny operations upon a resource (such as HyperText Transfer 
Protocol (HTTP) method invocations) by a given principal. A lightweight 
representation of principals as Web resources supports integration of a 
wide range of user management repositories. Search operations allow 
discovery and manipulation of principals using human names. 
This document is a product of the Web Distributed Authoring and 
Versioning (WebDAV) working group of the Internet Engineering Task 
Force. Comments on this draft are welcomed, and should be addressed to 
the acl@webdav.org mailing list. Other related documents can be found 
at http://www.example.com/acl/, and 
http://www.ics.uci.edu/pub/ietf/webdav/.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-webdav-acl-11.txt

To remove yourself from the IETF Announcement list, send a message to 
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-webdav-acl-11.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt


Internet-Drafts can also be obtained by e-mail.

Send a message to:
	mailserv@ietf.org.
In the body type:
	"FILE /internet-drafts/draft-ietf-webdav-acl-11.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.
		
		
Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--NextPart
Content-Type: Multipart/Alternative; Boundary="OtherAccess"

--OtherAccess
Content-Type: Message/External-body;
	access-type="mail-server";
	server="mailserv@ietf.org"

Content-Type: text/plain
Content-ID:	<2003-9-18090027.I-D@ietf.org>

ENCODING mime
FILE /internet-drafts/draft-ietf-webdav-acl-11.txt

--OtherAccess
Content-Type: Message/External-body;
	name="draft-ietf-webdav-acl-11.txt";
	site="ftp.ietf.org";
	access-type="anon-ftp";
	directory="internet-drafts"

Content-Type: text/plain
Content-ID:	<2003-9-18090027.I-D@ietf.org>

--OtherAccess--

--NextPart--




From w3c-dist-auth-request@w3.org  Thu Sep 18 11:37:59 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA18662
	for <webdav-archive@lists.ietf.org>; Thu, 18 Sep 2003 11:37:59 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 659EAA05DD; Thu, 18 Sep 2003 11:38:06 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id AF588A0646
	for <w3c-dist-auth@frink.w3.org>; Thu, 18 Sep 2003 11:38:03 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 8ABDC13B69; Thu, 18 Sep 2003 11:38:03 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from e2.ny.us.ibm.com (e2.ny.us.ibm.com [32.97.182.102])
	by dr-nick.w3.org (Postfix) with ESMTP id 54F9E1353B
	for <w3c-dist-auth@w3.org>; Thu, 18 Sep 2003 11:38:03 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e2.ny.us.ibm.com (8.12.10/8.12.2) with ESMTP id h8IFc2Xs171126
	for <w3c-dist-auth@w3.org>; Thu, 18 Sep 2003 11:38:02 -0400
Received: from d01hub03.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h8IFbrod219620
	for <w3c-dist-auth@w3.org>; Thu, 18 Sep 2003 11:38:00 -0400
In-Reply-To: <008b01c37d76$5106f810$f8cb90c6@lisalap>
To: w3c-dist-auth@w3.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
Message-ID: <OF8F5468FC.6A169A14-ON85256DA5.00428C89-85256DA5.00437974@us.ibm.com>
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Date: Thu, 18 Sep 2003 08:17:00 -0400
X-MIMETrack: Serialize by Router on D01HUB03/01/H/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/18/2003 11:38:00,
	Serialize complete at 09/18/2003 11:38:00
Content-Type: multipart/alternative; boundary="=_alternative 0043797085256DA5_="
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/OF8F5468FC.6A169A14-ON85256DA5.00428C89-85256DA5.00437974@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7880
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030918153806.659EAA05DD@frink.w3.org>
Resent-Date: Thu, 18 Sep 2003 11:38:06 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 0043797085256DA5_=
Content-Type: text/plain; charset="US-ASCII"

That is not correct.  RFC-2518 explicitly states in
section 13.8 (where the DAV:lockdiscovery property is defined):

"The server is free to withhold any or all of this information
if the requesting principal does not have sufficient access rights
to see the requested data."

In particular, if the client does not have sufficient access
rights to UNLOCK the resource, a server could very reasonably
choose to hide the lock-token information.

In addition, a server for which locks have a reasonably
short maximum expiration may chose to never expose the lock tokens
(i.e. nobody has sufficient access rights to see the lock tokens).

Cheers,
Geoff

w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:

> 
> I'd also point out that the lockdiscovery property MUST contain
> all the lock tokens, regardless of access control settings.  This
> is not considered a security leak, because authorization is also
> needed to use a lock token.  So this is the server logic to apply
> whenever the client provides a lock token: 
> 
> Is this the same authorization context that took out the lock? 
>   Yes {
>    Allow the operation normally, provided the operation is 
>    allowed, and provided the lock token is correct and all
>    required lock tokens are provided, etc.
>   } No {
>    Is this an UNLOCK operation, with an authorization that
>    includes permission to delete others' locks?
>    Yes {
>       perform UNLOCK
>    } No {
>       Fail request
>    }
>   }
> 
> Lisa
> 
> > -----Original Message-----
> > From: w3c-dist-auth-request@w3.org 
> > [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> > Sent: Wednesday, September 17, 2003 11:17 AM
> > To: 'Horst Liermann'; w3c-dist-auth@w3.org
> > Subject: RE: ACL and lockdiscovery
> > 
> > 
> > 
> > The ACL spec hasn't defined a privilege specifically to 
> > control read access to the lockdiscovery property, or even a 
> > privilege to control access to all the privileges in total. 
> > An individual server implementation could provide such a 
> > privilege and aggregate it under <dav:read>, but this isn't required.
> > 
> > --Eric
> > 
> > > -----Original Message-----
> > > From: w3c-dist-auth-request@w3.org 
> > > [mailto:w3c-dist-auth-request@w3.org]
> > > On Behalf Of Horst Liermann
> > > Sent: Wednesday, September 17, 2003 10:08 AM
> > > To: 'w3c-dist-auth@w3.org'
> > > 
> > > 
> > > Hi all,
> > > 
> > > some questions about lockdiscovery and ACL's
> > > 
> > > Suppose, you have a server with WebDAV ( including lock) and it 
> > > support's ACL. What is the behavior for lockdiscovery, can 
> > I see all 
> > > lock token or am I only allowed to see the tokens where I 
> > am the owner 
> > > of the lock ? As far as I understand, lockdiscovery reports 
> > all locks. 
> > > Is this a security leak ?
> > > 
> > > Best Regards
> > >    Horst
> > 
> > 
> > 
> 
> 

--=_alternative 0043797085256DA5_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2><tt>That is not correct. &nbsp;RFC-2518 explicitly states
in</tt></font>
<br><font size=2><tt>section 13.8 (where the DAV:lockdiscovery property
is defined):</tt></font>
<br>
<br><font size=2><tt>&quot;The server is free to withhold any or all of
this information</tt></font>
<br><font size=2><tt>if the requesting principal does not have sufficient
access rights</tt></font>
<br><font size=2><tt>to see the requested data.&quot;</tt></font>
<br>
<br><font size=2><tt>In particular, if the client does not have sufficient
access</tt></font>
<br><font size=2><tt>rights to UNLOCK the resource, a server could very
reasonably</tt></font>
<br><font size=2><tt>choose to hide the lock-token information.</tt></font>
<br>
<br><font size=2><tt>In addition, a server for which locks have a reasonably</tt></font>
<br><font size=2><tt>short maximum expiration may chose to never expose
the lock tokens</tt></font>
<br><font size=2><tt>(i.e. nobody has sufficient access rights to see the
lock tokens).</tt></font>
<br>
<br><font size=2><tt>Cheers,</tt></font>
<br><font size=2><tt>Geoff</tt></font>
<br>
<br><font size=2><tt>w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20
PM:<br>
<br>
&gt; <br>
&gt; I'd also point out that the lockdiscovery property MUST contain<br>
&gt; all the lock tokens, regardless of access control settings. &nbsp;This<br>
&gt; is not considered a security leak, because authorization is also<br>
&gt; needed to use a lock token. &nbsp;So this is the server logic to apply<br>
&gt; whenever the client provides a lock token: <br>
&gt; <br>
&gt; Is this the same authorization context that took out the lock? <br>
&gt; &nbsp; Yes {<br>
&gt; &nbsp; &nbsp;Allow the operation normally, provided the operation
is <br>
&gt; &nbsp; &nbsp;allowed, and provided the lock token is correct and all<br>
&gt; &nbsp; &nbsp;required lock tokens are provided, etc.<br>
&gt; &nbsp; } No {<br>
&gt; &nbsp; &nbsp;Is this an UNLOCK operation, with an authorization that<br>
&gt; &nbsp; &nbsp;includes permission to delete others' locks?<br>
&gt; &nbsp; &nbsp;Yes {<br>
&gt; &nbsp; &nbsp; &nbsp; perform UNLOCK<br>
&gt; &nbsp; &nbsp;} No {<br>
&gt; &nbsp; &nbsp; &nbsp; Fail request<br>
&gt; &nbsp; &nbsp;}<br>
&gt; &nbsp; }<br>
&gt; <br>
&gt; Lisa<br>
&gt; <br>
&gt; &gt; -----Original Message-----<br>
&gt; &gt; From: w3c-dist-auth-request@w3.org <br>
&gt; &gt; [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar<br>
&gt; &gt; Sent: Wednesday, September 17, 2003 11:17 AM<br>
&gt; &gt; To: 'Horst Liermann'; w3c-dist-auth@w3.org<br>
&gt; &gt; Subject: RE: ACL and lockdiscovery<br>
&gt; &gt; <br>
&gt; &gt; <br>
&gt; &gt; <br>
&gt; &gt; The ACL spec hasn't defined a privilege specifically to <br>
&gt; &gt; control read access to the lockdiscovery property, or even a
<br>
&gt; &gt; privilege to control access to all the privileges in total. &nbsp;<br>
&gt; &gt; An individual server implementation could provide such a <br>
&gt; &gt; privilege and aggregate it under &lt;dav:read&gt;, but this isn't
required.<br>
&gt; &gt; <br>
&gt; &gt; --Eric<br>
&gt; &gt; <br>
&gt; &gt; &gt; -----Original Message-----<br>
&gt; &gt; &gt; From: w3c-dist-auth-request@w3.org <br>
&gt; &gt; &gt; [mailto:w3c-dist-auth-request@w3.org]<br>
&gt; &gt; &gt; On Behalf Of Horst Liermann<br>
&gt; &gt; &gt; Sent: Wednesday, September 17, 2003 10:08 AM<br>
&gt; &gt; &gt; To: 'w3c-dist-auth@w3.org'<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; Hi all,<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; some questions about lockdiscovery and ACL's<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; Suppose, you have a server with WebDAV ( including lock)
and it <br>
&gt; &gt; &gt; support's ACL. What is the behavior for lockdiscovery, can
<br>
&gt; &gt; I see all <br>
&gt; &gt; &gt; lock token or am I only allowed to see the tokens where
I <br>
&gt; &gt; am the owner <br>
&gt; &gt; &gt; of the lock ? As far as I understand, lockdiscovery reports
<br>
&gt; &gt; all locks. <br>
&gt; &gt; &gt; Is this a security leak ?<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; Best Regards<br>
&gt; &gt; &gt; &nbsp; &nbsp;Horst<br>
&gt; &gt; <br>
&gt; &gt; <br>
&gt; &gt; <br>
&gt; <br>
&gt; <br>
</tt></font>
--=_alternative 0043797085256DA5_=--



From w3c-dist-auth-request@w3.org  Thu Sep 18 12:32:11 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA21787
	for <webdav-archive@lists.ietf.org>; Thu, 18 Sep 2003 12:32:11 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id EBDBEA05F2; Thu, 18 Sep 2003 12:32:18 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 262FCA058D
	for <w3c-dist-auth@frink.w3.org>; Thu, 18 Sep 2003 12:32:15 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 0B3F2135A7; Thu, 18 Sep 2003 12:32:15 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id B839D1359B
	for <w3c-dist-auth@w3.org>; Thu, 18 Sep 2003 12:32:14 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 1A01hV-0005cv-00; Thu, 18 Sep 2003 16:32:13 +0000
Received: from [192.168.1.151] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 1A01hU-0005cc-00; Thu, 18 Sep 2003 16:32:12 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: "'Geoffrey M Clemm'" <geoffrey.clemm@us.ibm.com>, <w3c-dist-auth@w3.org>
Date: Thu, 18 Sep 2003 09:32:20 -0700
Message-ID: <010501c37e02$6e8bb5b0$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0106_01C37DC7.C22CDDB0"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
Importance: Normal
In-Reply-To: <OF8F5468FC.6A169A14-ON85256DA5.00428C89-85256DA5.00437974@us.ibm.com>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Old-X-Envelope-To: geoffrey.clemm@us.ibm.com,
 w3c-dist-auth@w3.org
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/010501c37e02$6e8bb5b0$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7881
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030918163218.EBDBEA05F2@frink.w3.org>
Resent-Date: Thu, 18 Sep 2003 12:32:18 -0400 (EDT)


This is a multi-part message in MIME format.

------=_NextPart_000_0106_01C37DC7.C22CDDB0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

Unfortunately, withholding the locktoken from the client that requested =
that
lock
would break UNLOCK for some clients that don't store their own lock =
tokens.
Those clients might show error messages & cause support calls.
Thus, as a matter of interoperability, a server would at least have to=20
be careful in providing incomplete information in lockdiscovery.
=20
This area is murkier than I had thought.  Should there be a =
clarification in
RFC2518bis? It would obviously be easier to write interoperable clients=20
if all servers had to behave the same in this area.  Is there a de facto =

minimum standard here that we can clarify in the next rev?
=20
lisa

-----Original Message-----
From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org] =
On
Behalf Of Geoffrey M Clemm
Sent: Thursday, September 18, 2003 5:17 AM
To: w3c-dist-auth@w3.org
Subject: RE: ACL and lockdiscovery



That is not correct.  RFC-2518 explicitly states in=20
section 13.8 (where the DAV:lockdiscovery property is defined):=20

"The server is free to withhold any or all of this information=20
if the requesting principal does not have sufficient access rights=20
to see the requested data."=20

In particular, if the client does not have sufficient access=20
rights to UNLOCK the resource, a server could very reasonably=20
choose to hide the lock-token information.=20

In addition, a server for which locks have a reasonably=20
short maximum expiration may chose to never expose the lock tokens=20
(i.e. nobody has sufficient access rights to see the lock tokens).=20

Cheers,=20
Geoff=20

w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:

>=20
> I'd also point out that the lockdiscovery property MUST contain
> all the lock tokens, regardless of access control settings.  This
> is not considered a security leak, because authorization is also
> needed to use a lock token.  So this is the server logic to apply
> whenever the client provides a lock token:=20
>=20
> Is this the same authorization context that took out the lock?=20
>   Yes {
>    Allow the operation normally, provided the operation is=20
>    allowed, and provided the lock token is correct and all
>    required lock tokens are provided, etc.
>   } No {
>    Is this an UNLOCK operation, with an authorization that
>    includes permission to delete others' locks?
>    Yes {
>       perform UNLOCK
>    } No {
>       Fail request
>    }
>   }
>=20
> Lisa
>=20
> > -----Original Message-----
> > From: w3c-dist-auth-request@w3.org=20
> > [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> > Sent: Wednesday, September 17, 2003 11:17 AM
> > To: 'Horst Liermann'; w3c-dist-auth@w3.org
> > Subject: RE: ACL and lockdiscovery
> >=20
> >=20
> >=20
> > The ACL spec hasn't defined a privilege specifically to=20
> > control read access to the lockdiscovery property, or even a=20
> > privilege to control access to all the privileges in total. =20
> > An individual server implementation could provide such a=20
> > privilege and aggregate it under <dav:read>, but this isn't =
required.
> >=20
> > --Eric
> >=20
> > > -----Original Message-----
> > > From: w3c-dist-auth-request@w3.org=20
> > > [mailto:w3c-dist-auth-request@w3.org]
> > > On Behalf Of Horst Liermann
> > > Sent: Wednesday, September 17, 2003 10:08 AM
> > > To: 'w3c-dist-auth@w3.org'
> > >=20
> > >=20
> > > Hi all,
> > >=20
> > > some questions about lockdiscovery and ACL's
> > >=20
> > > Suppose, you have a server with WebDAV ( including lock) and it=20
> > > support's ACL. What is the behavior for lockdiscovery, can=20
> > I see all=20
> > > lock token or am I only allowed to see the tokens where I=20
> > am the owner=20
> > > of the lock ? As far as I understand, lockdiscovery reports=20
> > all locks.=20
> > > Is this a security leak ?
> > >=20
> > > Best Regards
> > >    Horst
> >=20
> >=20
> >=20
>=20
>=20



------=_NextPart_000_0106_01C37DC7.C22CDDB0
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<TITLE>Message</TITLE>

<META content=3D"MSHTML 6.00.2800.1226" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =

size=3D2>Unfortunately, withholding the locktoken from the client that =
requested=20
that lock</FONT></SPAN></DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =
size=3D2>would=20
break UNLOCK for some clients that don't store their own lock=20
tokens.</FONT></SPAN></DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =
size=3D2>Those=20
clients might show error messages &amp; cause support =
calls.</FONT></SPAN></DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =
size=3D2>Thus,=20
as a matter of interoperability, a server would at least have to=20
</FONT></SPAN></DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =
size=3D2>be=20
careful in providing incomplete information in=20
lockdiscovery.</FONT></SPAN></DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =
size=3D2>This=20
area is murkier than I had thought.&nbsp; Should there be a =
clarification=20
in</FONT></SPAN></DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =

size=3D2>RFC2518bis? It would obviously be easier to write interoperable =
clients=20
</FONT></SPAN></DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =
size=3D2>if all=20
servers had to behave the same in this area.&nbsp; Is there a de facto=20
</FONT></SPAN></DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =

size=3D2>minimum standard here that we can clarify in the next=20
rev?</FONT></SPAN></DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D045242916-18092003><FONT face=3DArial color=3D#0000ff =

size=3D2>lisa</FONT></SPAN></DIV>
<BLOCKQUOTE=20
style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px =
solid; MARGIN-RIGHT: 0px">
  <DIV></DIV>
  <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr =
align=3Dleft><FONT=20
  face=3DTahoma size=3D2>-----Original Message-----<BR><B>From:</B>=20
  w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org] =
<B>On=20
  Behalf Of </B>Geoffrey M Clemm<BR><B>Sent:</B> Thursday, September 18, =
2003=20
  5:17 AM<BR><B>To:</B> w3c-dist-auth@w3.org<BR><B>Subject:</B> RE: ACL =
and=20
  lockdiscovery<BR><BR></FONT></DIV><BR><FONT size=3D2><TT>That is not =
correct.=20
  &nbsp;RFC-2518 explicitly states in</TT></FONT> <BR><FONT =
size=3D2><TT>section=20
  13.8 (where the DAV:lockdiscovery property is defined):</TT></FONT>=20
  <BR><BR><FONT size=3D2><TT>"The server is free to withhold any or all =
of this=20
  information</TT></FONT> <BR><FONT size=3D2><TT>if the requesting =
principal does=20
  not have sufficient access rights</TT></FONT> <BR><FONT =
size=3D2><TT>to see the=20
  requested data."</TT></FONT> <BR><BR><FONT size=3D2><TT>In particular, =
if the=20
  client does not have sufficient access</TT></FONT> <BR><FONT =
size=3D2><TT>rights=20
  to UNLOCK the resource, a server could very reasonably</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>choose to hide the lock-token information.</TT></FONT>=20
  <BR><BR><FONT size=3D2><TT>In addition, a server for which locks have =
a=20
  reasonably</TT></FONT> <BR><FONT size=3D2><TT>short maximum expiration =
may chose=20
  to never expose the lock tokens</TT></FONT> <BR><FONT =
size=3D2><TT>(i.e. nobody=20
  has sufficient access rights to see the lock tokens).</TT></FONT>=20
  <BR><BR><FONT size=3D2><TT>Cheers,</TT></FONT> <BR><FONT=20
  size=3D2><TT>Geoff</TT></FONT> <BR><BR><FONT=20
  size=3D2><TT>w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 =

  PM:<BR><BR>&gt; <BR>&gt; I'd also point out that the lockdiscovery =
property=20
  MUST contain<BR>&gt; all the lock tokens, regardless of access control =

  settings. &nbsp;This<BR>&gt; is not considered a security leak, =
because=20
  authorization is also<BR>&gt; needed to use a lock token. &nbsp;So =
this is the=20
  server logic to apply<BR>&gt; whenever the client provides a lock =
token:=20
  <BR>&gt; <BR>&gt; Is this the same authorization context that took out =
the=20
  lock? <BR>&gt; &nbsp; Yes {<BR>&gt; &nbsp; &nbsp;Allow the operation =
normally,=20
  provided the operation is <BR>&gt; &nbsp; &nbsp;allowed, and provided =
the lock=20
  token is correct and all<BR>&gt; &nbsp; &nbsp;required lock tokens are =

  provided, etc.<BR>&gt; &nbsp; } No {<BR>&gt; &nbsp; &nbsp;Is this an =
UNLOCK=20
  operation, with an authorization that<BR>&gt; &nbsp; &nbsp;includes =
permission=20
  to delete others' locks?<BR>&gt; &nbsp; &nbsp;Yes {<BR>&gt; &nbsp; =
&nbsp;=20
  &nbsp; perform UNLOCK<BR>&gt; &nbsp; &nbsp;} No {<BR>&gt; &nbsp; =
&nbsp; &nbsp;=20
  Fail request<BR>&gt; &nbsp; &nbsp;}<BR>&gt; &nbsp; }<BR>&gt; <BR>&gt;=20
  Lisa<BR>&gt; <BR>&gt; &gt; -----Original Message-----<BR>&gt; &gt; =
From:=20
  w3c-dist-auth-request@w3.org <BR>&gt; &gt;=20
  [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar<BR>&gt; =
&gt;=20
  Sent: Wednesday, September 17, 2003 11:17 AM<BR>&gt; &gt; To: 'Horst=20
  Liermann'; w3c-dist-auth@w3.org<BR>&gt; &gt; Subject: RE: ACL and=20
  lockdiscovery<BR>&gt; &gt; <BR>&gt; &gt; <BR>&gt; &gt; <BR>&gt; &gt; =
The ACL=20
  spec hasn't defined a privilege specifically to <BR>&gt; &gt; control =
read=20
  access to the lockdiscovery property, or even a <BR>&gt; &gt; =
privilege to=20
  control access to all the privileges in total. &nbsp;<BR>&gt; &gt; An=20
  individual server implementation could provide such a <BR>&gt; &gt; =
privilege=20
  and aggregate it under &lt;dav:read&gt;, but this isn't =
required.<BR>&gt; &gt;=20
  <BR>&gt; &gt; --Eric<BR>&gt; &gt; <BR>&gt; &gt; &gt; -----Original=20
  Message-----<BR>&gt; &gt; &gt; From: w3c-dist-auth-request@w3.org =
<BR>&gt;=20
  &gt; &gt; [mailto:w3c-dist-auth-request@w3.org]<BR>&gt; &gt; &gt; On =
Behalf Of=20
  Horst Liermann<BR>&gt; &gt; &gt; Sent: Wednesday, September 17, 2003 =
10:08=20
  AM<BR>&gt; &gt; &gt; To: 'w3c-dist-auth@w3.org'<BR>&gt; &gt; &gt; =
<BR>&gt;=20
  &gt; &gt; <BR>&gt; &gt; &gt; Hi all,<BR>&gt; &gt; &gt; <BR>&gt; &gt; =
&gt; some=20
  questions about lockdiscovery and ACL's<BR>&gt; &gt; &gt; <BR>&gt; =
&gt; &gt;=20
  Suppose, you have a server with WebDAV ( including lock) and it =
<BR>&gt; &gt;=20
  &gt; support's ACL. What is the behavior for lockdiscovery, can =
<BR>&gt; &gt;=20
  I see all <BR>&gt; &gt; &gt; lock token or am I only allowed to see =
the tokens=20
  where I <BR>&gt; &gt; am the owner <BR>&gt; &gt; &gt; of the lock ? As =
far as=20
  I understand, lockdiscovery reports <BR>&gt; &gt; all locks. <BR>&gt; =
&gt;=20
  &gt; Is this a security leak ?<BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; =
Best=20
  Regards<BR>&gt; &gt; &gt; &nbsp; &nbsp;Horst<BR>&gt; &gt; <BR>&gt; =
&gt;=20
  <BR>&gt; &gt; <BR>&gt; <BR>&gt; =
<BR></BLOCKQUOTE></TT></FONT></BODY></HTML>

------=_NextPart_000_0106_01C37DC7.C22CDDB0--




From w3c-dist-auth-request@w3.org  Fri Sep 19 11:33:02 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA00989
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 11:32:57 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 591C5A0705; Thu, 18 Sep 2003 19:42:00 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 4F1B4A0705
	for <w3c-dist-auth@frink.w3.org>; Thu, 18 Sep 2003 19:41:58 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 2527913646; Thu, 18 Sep 2003 19:41:58 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id 07E2213639
	for <w3c-dist-auth@w3.org>; Thu, 18 Sep 2003 19:41:58 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 1A08PM-0001pD-00; Thu, 18 Sep 2003 23:41:56 +0000
Received: from [192.168.1.151] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 1A08PL-0001ow-00; Thu, 18 Sep 2003 23:41:55 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: "'Conal Tuohy'" <Conal.Tuohy@vuw.ac.nz>,
        "'WebDAV List (E-mail)'" <w3c-dist-auth@w3.org>
Date: Thu, 18 Sep 2003 16:41:56 -0700
Message-ID: <017c01c37e3e$760cac40$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
Importance: Normal
In-Reply-To: <5744FAECB4B8864F83CB05F2E1D16EEB154B9A@coso.staff.vuw.ac.nz>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Old-X-Envelope-To: Conal.Tuohy@vuw.ac.nz,
 w3c-dist-auth@w3.org
Subject: RE: multiple "source" properties documents
X-Archived-At: http://www.w3.org/mid/017c01c37e3e$760cac40$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7885
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030918234200.591C5A0705@frink.w3.org>
Resent-Date: Thu, 18 Sep 2003 19:42:00 -0400 (EDT)
Content-Transfer-Encoding: 7bit



> From what I read, the "source" property was a great idea but 
> no-one ever implemented it, supposedly because it was too 
> complicated and/or there was no perceived need. 

I'd characterize the reasons a little differently: 
 1) The feature was underspecified, there was never enough 
	information in the spec to be able to fully implement
	or interoperate
 2) Implementation interest was low -- we asked around to see
	who had implemented this feature and got no positive
	responses at all.

> Eventually it 
> was formally deprecated. Is this correct? 

The deprecation isn't final yet, but we are proposing to 
deprecate it.

> I've also read of 
> the "translate" header, which I gather is a 
> Microsoft-specific extension? I also gather that this only 
> supports a one-to-one mapping between a document and its 
> source, i.e. a document has one and only one source?

Yes

> My case is that I have a server which generates pages from 
> multiple sources and keeps track of those sources in such a 
> way that it could fairly easily support dav:source. I'd like 
> editors to be able to edit the page and select which of the 
> source documents to edit. But are there existing clients that 
> will actually do that? Or are there other web-dav mechanisms 
> that might support my use-case?

Not that I know of.  You'd be the first to implement a 
protocol feature to expose multiple mappings so nobody
to interoperate with and no tools to support your feature.

If there is sufficient interest from implementors to make
forward progress on this, I'd recommend a separate draft rather
than resurrect the unimplemented, underspecified, and untested
feature in RFC2518.

Lisa




From w3c-dist-auth-request@w3.org  Fri Sep 19 11:49:58 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA01444
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 11:49:53 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 23AC2A0E08; Fri, 19 Sep 2003 09:50:47 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 229EBA0E08
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 09:50:43 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id D944313E49; Fri, 19 Sep 2003 09:50:42 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from e3.ny.us.ibm.com (e3.ny.us.ibm.com [32.97.182.103])
	by dr-nick.w3.org (Postfix) with ESMTP id 937A113E42
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:50:42 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e3.ny.us.ibm.com (8.12.10/8.12.2) with ESMTP id h8JDog7A480620
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:50:42 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h8JDofOu203200
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:50:41 -0400
In-Reply-To: <JIEGINCHMLABHJBIGKBCEEGEIIAA.julian.reschke@gmx.de>
To: w3c-dist-auth@w3.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Message-ID: <OFD70D8E0C.14FFEB1E-ON85256DA6.004BD212-85256DA6.004C094E@us.ibm.com>
Date: Fri, 19 Sep 2003 09:50:30 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/19/2003 09:50:40,
	Serialize complete at 09/19/2003 09:50:40
Content-Type: multipart/alternative; boundary="=_alternative 004C050785256DA6_="
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/OFD70D8E0C.14FFEB1E-ON85256DA6.004BD212-85256DA6.004C094E@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7890
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919135047.23AC2A0E08@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 09:50:47 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 004C050785256DA6_=
Content-Type: text/plain; charset="US-ASCII"

Just to be clear, I was in no way advocating that the presence
of the lock itself should be hidden.  I was just indicating the
cases when the suppression of the *lock-token* field in the
lock-discovery data is likely to be desireable.

Cheers,
Geoff

w3c-dist-auth-request@w3.org wrote on 09/19/2003 09:26:50 AM:

> I basically agree with Geoff.
> 
> However there's the legitamite use case that a UI needs to get the 
> active locks just in order to be able to display whether a resource 
> is locked or not. So maybe we should think of a way that handles 
> this case, without having to reveal "too much".
> 
> Julian
> --
> <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760 
> -----Original Message-----
> From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]
> On Behalf Of Geoffrey M Clemm
> Sent: Friday, September 19, 2003 3:19 PM
> To: w3c-dist-auth@w3.org
> Subject: RE: ACL and lockdiscovery

> 
> If the client doesn't have permission to do an UNLOCK, 
> or if the lock automatically times out 
> (the two use cases identified where the server is likely to withhold 
> the lock token), the client either cannot do an UNLOCK, or does not 
> need to do an UNLOCK. 
> 
> WRT clients that do not store the lock tokens, but rather try to steal 
> any lock token that is allowed by access control, this violates the 
whole 
> point of having lock tokens instead of just a server-side lock 
(i.e.preventing
> two clients working on behalf of the same user from stomping on each 
other), 
> and such a client should be fixed, not catered to by servers. 
> 
> Cheers, 
> Geoff 
> 
> "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003 12:32:20 PM:
> 
> > Unfortunately, withholding the locktoken from the client that 
> > requested that lock 
> > would break UNLOCK for some clients that don't store their own lock 
tokens.
> > Those clients might show error messages & cause support calls. 
> > Thus, as a matter of interoperability, a server would at least have to 

> > be careful in providing incomplete information in lockdiscovery. 
> > 
> > This area is murkier than I had thought.  Should there be a 
clarification in
> > RFC2518bis? It would obviously be easier to write interoperable 
clients 
> > if all servers had to behave the same in this area.  Is there a de 
facto 
> > minimum standard here that we can clarify in the next rev? 
> > 
> > lisa 
> > -----Original Message-----
> > From: w3c-dist-auth-request@w3.org 
[mailto:w3c-dist-auth-request@w3.org] 
> > On Behalf Of Geoffrey M Clemm
> > Sent: Thursday, September 18, 2003 5:17 AM
> > To: w3c-dist-auth@w3.org
> > Subject: RE: ACL and lockdiscovery
> 
> > 
> > That is not correct.  RFC-2518 explicitly states in 
> > section 13.8 (where the DAV:lockdiscovery property is defined): 
> > 
> > "The server is free to withhold any or all of this information 
> > if the requesting principal does not have sufficient access rights 
> > to see the requested data." 
> > 
> > In particular, if the client does not have sufficient access 
> > rights to UNLOCK the resource, a server could very reasonably 
> > choose to hide the lock-token information. 
> > 
> > In addition, a server for which locks have a reasonably 
> > short maximum expiration may chose to never expose the lock tokens 
> > (i.e. nobody has sufficient access rights to see the lock tokens). 
> > 
> > Cheers, 
> > Geoff 
> > 
> > w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
> > 
> > > 
> > > I'd also point out that the lockdiscovery property MUST contain
> > > all the lock tokens, regardless of access control settings.  This
> > > is not considered a security leak, because authorization is also
> > > needed to use a lock token.  So this is the server logic to apply
> > > whenever the client provides a lock token: 
> > > 
> > > Is this the same authorization context that took out the lock? 
> > >   Yes {
> > >    Allow the operation normally, provided the operation is 
> > >    allowed, and provided the lock token is correct and all
> > >    required lock tokens are provided, etc.
> > >   } No {
> > >    Is this an UNLOCK operation, with an authorization that
> > >    includes permission to delete others' locks?
> > >    Yes {
> > >       perform UNLOCK
> > >    } No {
> > >       Fail request
> > >    }
> > >   }
> > > 
> > > Lisa
> > > 
> > > > -----Original Message-----
> > > > From: w3c-dist-auth-request@w3.org 
> > > > [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> > > > Sent: Wednesday, September 17, 2003 11:17 AM
> > > > To: 'Horst Liermann'; w3c-dist-auth@w3.org
> > > > Subject: RE: ACL and lockdiscovery
> > > > 
> > > > 
> > > > 
> > > > The ACL spec hasn't defined a privilege specifically to 
> > > > control read access to the lockdiscovery property, or even a 
> > > > privilege to control access to all the privileges in total. 
> > > > An individual server implementation could provide such a 
> > > > privilege and aggregate it under <dav:read>, but this isn't 
required.
> > > > 
> > > > --Eric
> > > > 
> > > > > -----Original Message-----
> > > > > From: w3c-dist-auth-request@w3.org 
> > > > > [mailto:w3c-dist-auth-request@w3.org]
> > > > > On Behalf Of Horst Liermann
> > > > > Sent: Wednesday, September 17, 2003 10:08 AM
> > > > > To: 'w3c-dist-auth@w3.org'
> > > > > 
> > > > > 
> > > > > Hi all,
> > > > > 
> > > > > some questions about lockdiscovery and ACL's
> > > > > 
> > > > > Suppose, you have a server with WebDAV ( including lock) and it 
> > > > > support's ACL. What is the behavior for lockdiscovery, can 
> > > > I see all 
> > > > > lock token or am I only allowed to see the tokens where I 
> > > > am the owner 
> > > > > of the lock ? As far as I understand, lockdiscovery reports 
> > > > all locks. 
> > > > > Is this a security leak ?
> > > > > 
> > > > > Best Regards
> > > > >    Horst
> > > > 
> > > > 
> > > > 
> > > 
> > > 
--=_alternative 004C050785256DA6_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2><tt>Just to be clear, I was in no way advocating that
the presence</tt></font>
<br><font size=2><tt>of the lock itself should be hidden. &nbsp;I was just
indicating the</tt></font>
<br><font size=2><tt>cases when the suppression of the *lock-token* field
in the</tt></font>
<br><font size=2><tt>lock-discovery data is likely to be desireable.</tt></font>
<br>
<br><font size=2><tt>Cheers,</tt></font>
<br><font size=2><tt>Geoff</tt></font>
<br>
<br><font size=2><tt>w3c-dist-auth-request@w3.org wrote on 09/19/2003 09:26:50
AM:<br>
<br>
&gt; I basically agree with Geoff.</tt></font>
<br><font size=2><tt>&gt; &nbsp;</tt></font>
<br><font size=2><tt>&gt; However there's the legitamite use case that
a UI needs to get the <br>
&gt; active locks just in order to be able to display whether a resource
<br>
&gt; is locked or not. So maybe we should think of a way that handles <br>
&gt; this case, without having to reveal &quot;too much&quot;.</tt></font>
<br><font size=2><tt>&gt; &nbsp;</tt></font>
<br><font size=2><tt>&gt; Julian</tt></font>
<br><font size=2><tt>&gt; --<br>
&gt; &lt;green/&gt;bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
</tt></font>
<br><font size=2><tt>&gt; -----Original Message-----<br>
&gt; From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]<br>
&gt; On Behalf Of Geoffrey M Clemm<br>
&gt; Sent: Friday, September 19, 2003 3:19 PM<br>
&gt; To: w3c-dist-auth@w3.org<br>
&gt; Subject: RE: ACL and lockdiscovery<br>
</tt></font>
<br><font size=2><tt>&gt; <br>
&gt; If the client doesn't have permission to do an UNLOCK, <br>
&gt; or if the lock automatically times out <br>
&gt; (the two use cases identified where the server is likely to withhold
<br>
&gt; the lock token), the client either cannot do an UNLOCK, or does not
<br>
&gt; need to do an UNLOCK. <br>
&gt; <br>
&gt; WRT clients that do not store the lock tokens, but rather try to steal
<br>
&gt; any lock token that is allowed by access control, this violates the
whole <br>
&gt; point of having lock tokens instead of just a server-side lock (i.e.preventing<br>
&gt; two clients working on behalf of the same user from stomping on each
other), <br>
&gt; and such a client should be fixed, not catered to by servers. <br>
&gt; <br>
&gt; Cheers, <br>
&gt; Geoff <br>
&gt; <br>
&gt; &quot;Lisa Dusseault&quot; &lt;lisa@xythos.com&gt; wrote on 09/18/2003
12:32:20 PM:<br>
&gt; <br>
&gt; &gt; Unfortunately, withholding the locktoken from the client that
<br>
&gt; &gt; requested that lock <br>
&gt; &gt; would break UNLOCK for some clients that don't store their own
lock tokens.<br>
&gt; &gt; Those clients might show error messages &amp; cause support calls.
<br>
&gt; &gt; Thus, as a matter of interoperability, a server would at least
have to <br>
&gt; &gt; be careful in providing incomplete information in lockdiscovery.
<br>
&gt; &gt; &nbsp; <br>
&gt; &gt; This area is murkier than I had thought. &nbsp;Should there be
a clarification in<br>
&gt; &gt; RFC2518bis? It would obviously be easier to write interoperable
clients <br>
&gt; &gt; if all servers had to behave the same in this area. &nbsp;Is
there a de facto <br>
&gt; &gt; minimum standard here that we can clarify in the next rev? <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; lisa <br>
&gt; &gt; -----Original Message-----<br>
&gt; &gt; From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]
<br>
&gt; &gt; On Behalf Of Geoffrey M Clemm<br>
&gt; &gt; Sent: Thursday, September 18, 2003 5:17 AM<br>
&gt; &gt; To: w3c-dist-auth@w3.org<br>
&gt; &gt; Subject: RE: ACL and lockdiscovery<br>
&gt; <br>
&gt; &gt; <br>
&gt; &gt; That is not correct. &nbsp;RFC-2518 explicitly states in <br>
&gt; &gt; section 13.8 (where the DAV:lockdiscovery property is defined):
<br>
&gt; &gt; <br>
&gt; &gt; &quot;The server is free to withhold any or all of this information
<br>
&gt; &gt; if the requesting principal does not have sufficient access rights
<br>
&gt; &gt; to see the requested data.&quot; <br>
&gt; &gt; <br>
&gt; &gt; In particular, if the client does not have sufficient access
<br>
&gt; &gt; rights to UNLOCK the resource, a server could very reasonably
<br>
&gt; &gt; choose to hide the lock-token information. <br>
&gt; &gt; <br>
&gt; &gt; In addition, a server for which locks have a reasonably <br>
&gt; &gt; short maximum expiration may chose to never expose the lock tokens
<br>
&gt; &gt; (i.e. nobody has sufficient access rights to see the lock tokens).
<br>
&gt; &gt; <br>
&gt; &gt; Cheers, <br>
&gt; &gt; Geoff <br>
&gt; &gt; <br>
&gt; &gt; w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:<br>
&gt; &gt; <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; I'd also point out that the lockdiscovery property MUST
contain<br>
&gt; &gt; &gt; all the lock tokens, regardless of access control settings.
&nbsp;This<br>
&gt; &gt; &gt; is not considered a security leak, because authorization
is also<br>
&gt; &gt; &gt; needed to use a lock token. &nbsp;So this is the server
logic to apply<br>
&gt; &gt; &gt; whenever the client provides a lock token: <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; Is this the same authorization context that took out the
lock? <br>
&gt; &gt; &gt; &nbsp; Yes {<br>
&gt; &gt; &gt; &nbsp; &nbsp;Allow the operation normally, provided the
operation is <br>
&gt; &gt; &gt; &nbsp; &nbsp;allowed, and provided the lock token is correct
and all<br>
&gt; &gt; &gt; &nbsp; &nbsp;required lock tokens are provided, etc.<br>
&gt; &gt; &gt; &nbsp; } No {<br>
&gt; &gt; &gt; &nbsp; &nbsp;Is this an UNLOCK operation, with an authorization
that<br>
&gt; &gt; &gt; &nbsp; &nbsp;includes permission to delete others' locks?<br>
&gt; &gt; &gt; &nbsp; &nbsp;Yes {<br>
&gt; &gt; &gt; &nbsp; &nbsp; &nbsp; perform UNLOCK<br>
&gt; &gt; &gt; &nbsp; &nbsp;} No {<br>
&gt; &gt; &gt; &nbsp; &nbsp; &nbsp; Fail request<br>
&gt; &gt; &gt; &nbsp; &nbsp;}<br>
&gt; &gt; &gt; &nbsp; }<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; Lisa<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; -----Original Message-----<br>
&gt; &gt; &gt; &gt; From: w3c-dist-auth-request@w3.org <br>
&gt; &gt; &gt; &gt; [mailto:w3c-dist-auth-request@w3.org] On Behalf Of
Eric Sedlar<br>
&gt; &gt; &gt; &gt; Sent: Wednesday, September 17, 2003 11:17 AM<br>
&gt; &gt; &gt; &gt; To: 'Horst Liermann'; w3c-dist-auth@w3.org<br>
&gt; &gt; &gt; &gt; Subject: RE: ACL and lockdiscovery<br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; The ACL spec hasn't defined a privilege specifically
to <br>
&gt; &gt; &gt; &gt; control read access to the lockdiscovery property,
or even a <br>
&gt; &gt; &gt; &gt; privilege to control access to all the privileges in
total. &nbsp;<br>
&gt; &gt; &gt; &gt; An individual server implementation could provide such
a <br>
&gt; &gt; &gt; &gt; privilege and aggregate it under &lt;dav:read&gt;,
but this isn't required.<br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; --Eric<br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; -----Original Message-----<br>
&gt; &gt; &gt; &gt; &gt; From: w3c-dist-auth-request@w3.org <br>
&gt; &gt; &gt; &gt; &gt; [mailto:w3c-dist-auth-request@w3.org]<br>
&gt; &gt; &gt; &gt; &gt; On Behalf Of Horst Liermann<br>
&gt; &gt; &gt; &gt; &gt; Sent: Wednesday, September 17, 2003 10:08 AM<br>
&gt; &gt; &gt; &gt; &gt; To: 'w3c-dist-auth@w3.org'<br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; Hi all,<br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; some questions about lockdiscovery and ACL's<br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; Suppose, you have a server with WebDAV ( including
lock) and it <br>
&gt; &gt; &gt; &gt; &gt; support's ACL. What is the behavior for lockdiscovery,
can <br>
&gt; &gt; &gt; &gt; I see all <br>
&gt; &gt; &gt; &gt; &gt; lock token or am I only allowed to see the tokens
where I <br>
&gt; &gt; &gt; &gt; am the owner <br>
&gt; &gt; &gt; &gt; &gt; of the lock ? As far as I understand, lockdiscovery
reports <br>
&gt; &gt; &gt; &gt; all locks. <br>
&gt; &gt; &gt; &gt; &gt; Is this a security leak ?<br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; Best Regards<br>
&gt; &gt; &gt; &gt; &gt; &nbsp; &nbsp;Horst<br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; </tt></font>
--=_alternative 004C050785256DA6_=--



From w3c-dist-auth-request@w3.org  Fri Sep 19 11:50:52 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA01453
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 11:50:51 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id B0E6DA05A5; Thu, 18 Sep 2003 14:16:25 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 3D050A05B7
	for <w3c-dist-auth@frink.w3.org>; Thu, 18 Sep 2003 14:16:19 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id CC38413463; Thu, 18 Sep 2003 14:16:18 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ucsc.edu (cats-mx1.ucsc.edu [128.114.129.36])
	by dr-nick.w3.org (Postfix) with ESMTP id 59E35135CE
	for <w3c-dist-auth@w3.org>; Thu, 18 Sep 2003 14:16:18 -0400 (EDT)
Received: from Tycho (dhcp-55-196.cse.ucsc.edu [128.114.55.196])
	by ucsc.edu (8.10.1/8.10.1) with SMTP id h8IIC0a16361
	for <w3c-dist-auth@w3.org>; Thu, 18 Sep 2003 11:12:00 -0700 (PDT)
From: "Jim Whitehead" <ejw@cse.ucsc.edu>
To: "WebDAV" <w3c-dist-auth@w3.org>
Date: Thu, 18 Sep 2003 11:13:49 -0700
Message-ID: <AMEPKEBLDJJCCDEJHAMIAEIGJFAA.ejw@cse.ucsc.edu>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-UCSC-CATS-MailScanner: Found to be clean
Subject: FW: [Moderator Action] litmus test, dangers of
X-Archived-At: http://www.w3.org/mid/AMEPKEBLDJJCCDEJHAMIAEIGJFAA.ejw@cse.ucsc.edu
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7882
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030918181625.B0E6DA05A5@frink.w3.org>
Resent-Date: Thu, 18 Sep 2003 14:16:25 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Accidentally caught by the spam filter.

- Jim

-----Original Message-----
From: Frank Lowney [mailto:frank.lowney@gcsu.edu]
Sent: Thursday, September 18, 2003 6:23 AM
To: w3c-dist-auth@w3.org
Subject: [Moderator Action] litmus test, dangers of




I am trying to convince the sysadmins of our University System to run
the litmus test against their WebCT Vista server (based on BEA
WebLogic webserver and Oracle backend DB) to help us understand why
certain clients have difficulty with this system.

They have only their production environment at this time (a dev
system is planned, hoped-for) so are reluctant to run the litmus
test.  So my questions are these:

1) Is this reluctance justified?  That is, would running the litmus
test on a production server entail a risk of any significance?

2) If the reluctance is not justified, how might we allay their
fears?  Is there anything from w3c (statements, etc.) that could be
used in this endeavor?

Using WebDAV in WebCT Vista is a little different from other systems.
Courseware developers elect to use WebDAV at some point in a course
under development by clicking on a button labeled "WebDAV."  The
WebCT Vista system responds with a long and complex URI that the
courseware developer copies for pasting into their WebDAV-compliant
application or OS interface for WebDAV.

The length of these URIs can be problematic for IE in Win2K and XP.
Sometimes, it will generate a "too long" error message from "My
Network Places" as well. MacOS X doesn't complain about the length
but has other issues I won't go into here.  Here's a typical example
of one of those WebCT Vista WebDAV URIs:

http://131.96.160.58:8000/webct/webdav/131.96.160.58-1044482159055-328326100
1.clocks/University+System+of+Georgia/Georgia+College+and+State+University/E
IS+Testing/Banner+Event+Manager/Banner+Event+Management+01/Section+Content

That's 226 characters.

--
=====================================================================
Dr. Frank Lowney  frank.lowney@gcsu.edu
     Director, Electronic Instructional Services, a unit of the
     Office of Information and Instructional Technology,
     Professional Pages: http://www.gcsu.edu/oiit/eis/
     Personal Pages: http://www.faculty.de.gcsu.edu/~flowney
Voice: (478) 445-5260
=====================================================================
We don't make instruction effective, we make effective instruction
more accessible.

Please note that my new e-mail address is: frank.lowney@gcsu.edu



From w3c-dist-auth-request@w3.org  Fri Sep 19 11:51:21 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA01459
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 11:51:21 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id B7732A075B; Thu, 18 Sep 2003 14:16:28 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id DE9B6A075B
	for <w3c-dist-auth@frink.w3.org>; Thu, 18 Sep 2003 14:16:26 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 794661342E; Thu, 18 Sep 2003 14:16:26 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ucsc.edu (cats-mx1.ucsc.edu [128.114.129.36])
	by dr-nick.w3.org (Postfix) with ESMTP id 1397D133CC
	for <w3c-dist-auth@w3.org>; Thu, 18 Sep 2003 14:16:26 -0400 (EDT)
Received: from Tycho (dhcp-55-196.cse.ucsc.edu [128.114.55.196])
	by ucsc.edu (8.10.1/8.10.1) with SMTP id h8IIC0a16365;
	Thu, 18 Sep 2003 11:12:01 -0700 (PDT)
From: "Jim Whitehead" <ejw@cse.ucsc.edu>
To: "Frank Lowney" <frank.lowney@gcsu.edu>
Cc: "WebDAV" <w3c-dist-auth@w3.org>
Date: Thu, 18 Sep 2003 11:13:50 -0700
Message-ID: <AMEPKEBLDJJCCDEJHAMICEIGJFAA.ejw@cse.ucsc.edu>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
In-Reply-To: <a06002002bb8f5d428d12@[192.168.1.102]>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-UCSC-CATS-MailScanner: Found to be clean
Subject: RE: [Moderator Action] litmus test, dangers of
X-Archived-At: http://www.w3.org/mid/AMEPKEBLDJJCCDEJHAMICEIGJFAA.ejw@cse.ucsc.edu
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7883
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030918181628.B7732A075B@frink.w3.org>
Resent-Date: Thu, 18 Sep 2003 14:16:28 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Hi Frank,

> 1) Is this reluctance justified?  That is, would running the litmus
> test on a production server entail a risk of any significance?

There have been cases where running Litmus exposed an error that caused a
server to crash, and stop running. If Litmus is run against a collection
which does not contain production data, then there should be minimal danger
of data loss (the only risk would be Litmus exposing a bug that corrupted
the database).

So, I'd recommend running the test early some morning, when system use is
minimal.

> 2) If the reluctance is not justified, how might we allay their
> fears?  Is there anything from w3c (statements, etc.) that could be
> used in this endeavor?

The other approach would be to install WebCT on a test machine, and then run
Litmus against it.

> Using WebDAV in WebCT Vista is a little different from other systems.
> Courseware developers elect to use WebDAV at some point in a course
> under development by clicking on a button labeled "WebDAV."  The
> WebCT Vista system responds with a long and complex URI that the
> courseware developer copies for pasting into their WebDAV-compliant
> application or OS interface for WebDAV.
>
> The length of these URIs can be problematic for IE in Win2K and XP.
> Sometimes, it will generate a "too long" error message from "My
> Network Places" as well. MacOS X doesn't complain about the length
> but has other issues I won't go into here.  Here's a typical example
> of one of those WebCT Vista WebDAV URIs:

Litmus is unlikely to uncover a problem such as this, since this is more of
an interoperability problem, than a compliance problem. Litmus tests for
compliance.

Hope this helps.

- Jim



From w3c-dist-auth-request@w3.org  Fri Sep 19 12:12:28 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA09165
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 12:12:25 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 67A5CA0884; Fri, 19 Sep 2003 12:12:29 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 76E1AA0EB8
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 12:12:14 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 91406142B7; Fri, 19 Sep 2003 12:10:45 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id BA2B7142D1
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 12:10:44 -0400 (EDT)
Received: (qmail 10791 invoked by uid 65534); 19 Sep 2003 16:10:37 -0000
Received: from unknown (HELO lisa) (217.5.201.10)
  by mail.gmx.net (mp013) with SMTP; 19 Sep 2003 18:10:37 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Geoffrey M Clemm" <geoffrey.clemm@us.ibm.com>, <w3c-dist-auth@w3.org>
Date: Fri, 19 Sep 2003 18:10:36 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCKEHAIIAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_015C_01C37ED9.5367CB20"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
In-reply-to: <OFD70D8E0C.14FFEB1E-ON85256DA6.004BD212-85256DA6.004C094E@us.ibm.com>
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCKEHAIIAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7891
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919161229.67A5CA0884@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 12:12:29 -0400 (EDT)


This is a multi-part message in MIME format.

------=_NextPart_000_015C_01C37ED9.5367CB20
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

OK,

so what's the best interoperable way to hide the lock token? Simply leaving
out the locktoken/href element, or supplying a dummy (such as "DAV:private")
instead? Does any currently deployed server do this already?

Julian
--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

  -----Original Message-----
  From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]On
Behalf Of Geoffrey M Clemm
  Sent: Friday, September 19, 2003 3:51 PM
  To: w3c-dist-auth@w3.org
  Subject: RE: ACL and lockdiscovery



  Just to be clear, I was in no way advocating that the presence
  of the lock itself should be hidden.  I was just indicating the
  cases when the suppression of the *lock-token* field in the
  lock-discovery data is likely to be desireable.

  Cheers,
  Geoff

  w3c-dist-auth-request@w3.org wrote on 09/19/2003 09:26:50 AM:

  > I basically agree with Geoff.
  >
  > However there's the legitamite use case that a UI needs to get the
  > active locks just in order to be able to display whether a resource
  > is locked or not. So maybe we should think of a way that handles
  > this case, without having to reveal "too much".
  >
  > Julian
  > --
  > <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
  > -----Original Message-----
  > From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]
  > On Behalf Of Geoffrey M Clemm
  > Sent: Friday, September 19, 2003 3:19 PM
  > To: w3c-dist-auth@w3.org
  > Subject: RE: ACL and lockdiscovery

  >
  > If the client doesn't have permission to do an UNLOCK,
  > or if the lock automatically times out
  > (the two use cases identified where the server is likely to withhold
  > the lock token), the client either cannot do an UNLOCK, or does not
  > need to do an UNLOCK.
  >
  > WRT clients that do not store the lock tokens, but rather try to steal
  > any lock token that is allowed by access control, this violates the
whole
  > point of having lock tokens instead of just a server-side lock
(i.e.preventing
  > two clients working on behalf of the same user from stomping on each
other),
  > and such a client should be fixed, not catered to by servers.
  >
  > Cheers,
  > Geoff
  >
  > "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003 12:32:20 PM:
  >
  > > Unfortunately, withholding the locktoken from the client that
  > > requested that lock
  > > would break UNLOCK for some clients that don't store their own lock
tokens.
  > > Those clients might show error messages & cause support calls.
  > > Thus, as a matter of interoperability, a server would at least have to
  > > be careful in providing incomplete information in lockdiscovery.
  > >
  > > This area is murkier than I had thought.  Should there be a
clarification in
  > > RFC2518bis? It would obviously be easier to write interoperable
clients
  > > if all servers had to behave the same in this area.  Is there a de
facto
  > > minimum standard here that we can clarify in the next rev?
  > >
  > > lisa
  > > -----Original Message-----
  > > From: w3c-dist-auth-request@w3.org
[mailto:w3c-dist-auth-request@w3.org]
  > > On Behalf Of Geoffrey M Clemm
  > > Sent: Thursday, September 18, 2003 5:17 AM
  > > To: w3c-dist-auth@w3.org
  > > Subject: RE: ACL and lockdiscovery
  >
  > >
  > > That is not correct.  RFC-2518 explicitly states in
  > > section 13.8 (where the DAV:lockdiscovery property is defined):
  > >
  > > "The server is free to withhold any or all of this information
  > > if the requesting principal does not have sufficient access rights
  > > to see the requested data."
  > >
  > > In particular, if the client does not have sufficient access
  > > rights to UNLOCK the resource, a server could very reasonably
  > > choose to hide the lock-token information.
  > >
  > > In addition, a server for which locks have a reasonably
  > > short maximum expiration may chose to never expose the lock tokens
  > > (i.e. nobody has sufficient access rights to see the lock tokens).
  > >
  > > Cheers,
  > > Geoff
  > >
  > > w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
  > >
  > > >
  > > > I'd also point out that the lockdiscovery property MUST contain
  > > > all the lock tokens, regardless of access control settings.  This
  > > > is not considered a security leak, because authorization is also
  > > > needed to use a lock token.  So this is the server logic to apply
  > > > whenever the client provides a lock token:
  > > >
  > > > Is this the same authorization context that took out the lock?
  > > >   Yes {
  > > >    Allow the operation normally, provided the operation is
  > > >    allowed, and provided the lock token is correct and all
  > > >    required lock tokens are provided, etc.
  > > >   } No {
  > > >    Is this an UNLOCK operation, with an authorization that
  > > >    includes permission to delete others' locks?
  > > >    Yes {
  > > >       perform UNLOCK
  > > >    } No {
  > > >       Fail request
  > > >    }
  > > >   }
  > > >
  > > > Lisa
  > > >
  > > > > -----Original Message-----
  > > > > From: w3c-dist-auth-request@w3.org
  > > > > [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
  > > > > Sent: Wednesday, September 17, 2003 11:17 AM
  > > > > To: 'Horst Liermann'; w3c-dist-auth@w3.org
  > > > > Subject: RE: ACL and lockdiscovery
  > > > >
  > > > >
  > > > >
  > > > > The ACL spec hasn't defined a privilege specifically to
  > > > > control read access to the lockdiscovery property, or even a
  > > > > privilege to control access to all the privileges in total.
  > > > > An individual server implementation could provide such a
  > > > > privilege and aggregate it under <dav:read>, but this isn't
required.
  > > > >
  > > > > --Eric
  > > > >
  > > > > > -----Original Message-----
  > > > > > From: w3c-dist-auth-request@w3.org
  > > > > > [mailto:w3c-dist-auth-request@w3.org]
  > > > > > On Behalf Of Horst Liermann
  > > > > > Sent: Wednesday, September 17, 2003 10:08 AM
  > > > > > To: 'w3c-dist-auth@w3.org'
  > > > > >
  > > > > >
  > > > > > Hi all,
  > > > > >
  > > > > > some questions about lockdiscovery and ACL's
  > > > > >
  > > > > > Suppose, you have a server with WebDAV ( including lock) and it
  > > > > > support's ACL. What is the behavior for lockdiscovery, can
  > > > > I see all
  > > > > > lock token or am I only allowed to see the tokens where I
  > > > > am the owner
  > > > > > of the lock ? As far as I understand, lockdiscovery reports
  > > > > all locks.
  > > > > > Is this a security leak ?
  > > > > >
  > > > > > Best Regards
  > > > > >    Horst
  > > > >
  > > > >
  > > > >
  > > >
  > > >

------=_NextPart_000_015C_01C37ED9.5367CB20
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1226" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D803100916-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>OK,</FONT></SPAN></DIV>
<DIV><SPAN class=3D803100916-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D803100916-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>so what's the best interoperable way to hide the lock token? =
Simply=20
leaving out the locktoken/href element, or supplying a dummy (such as=20
"DAV:private") instead? Does any currently deployed server do this=20
already?</FONT></SPAN></DIV>
<DIV><FONT face=3D"Courier New" color=3D#0000ff =
size=3D2></FONT>&nbsp;</DIV>
<DIV><SPAN class=3D803100916-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>Julian</FONT></SPAN></DIV>
<P><FONT size=3D2>--<BR>&lt;green/&gt;bytes GmbH -- <A=20
href=3D"http://www.greenbytes.de/" =
target=3D_blank>http://www.greenbytes.de</A> --=20
tel:+492512807760 </FONT></P>
<BLOCKQUOTE=20
style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px =
solid">
  <DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
  size=3D2>-----Original Message-----<BR><B>From:</B> =
w3c-dist-auth-request@w3.org=20
  [mailto:w3c-dist-auth-request@w3.org]<B>On Behalf Of </B>Geoffrey M=20
  Clemm<BR><B>Sent:</B> Friday, September 19, 2003 3:51 PM<BR><B>To:</B> =

  w3c-dist-auth@w3.org<BR><B>Subject:</B> RE: ACL and=20
  lockdiscovery<BR><BR></FONT></DIV><BR><FONT size=3D2><TT>Just to be =
clear, I was=20
  in no way advocating that the presence</TT></FONT> <BR><FONT =
size=3D2><TT>of the=20
  lock itself should be hidden. &nbsp;I was just indicating =
the</TT></FONT>=20
  <BR><FONT size=3D2><TT>cases when the suppression of the *lock-token* =
field in=20
  the</TT></FONT> <BR><FONT size=3D2><TT>lock-discovery data is likely =
to be=20
  desireable.</TT></FONT> <BR><BR><FONT size=3D2><TT>Cheers,</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>Geoff</TT></FONT> <BR><BR><FONT=20
  size=3D2><TT>w3c-dist-auth-request@w3.org wrote on 09/19/2003 09:26:50 =

  AM:<BR><BR>&gt; I basically agree with Geoff.</TT></FONT> <BR><FONT=20
  size=3D2><TT>&gt; &nbsp;</TT></FONT> <BR><FONT size=3D2><TT>&gt; =
However there's=20
  the legitamite use case that a UI needs to get the <BR>&gt; active =
locks just=20
  in order to be able to display whether a resource <BR>&gt; is locked =
or not.=20
  So maybe we should think of a way that handles <BR>&gt; this case, =
without=20
  having to reveal "too much".</TT></FONT> <BR><FONT size=3D2><TT>&gt;=20
  &nbsp;</TT></FONT> <BR><FONT size=3D2><TT>&gt; Julian</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>&gt; --<BR>&gt; &lt;green/&gt;bytes GmbH --=20
  http://www.greenbytes.de -- tel:+492512807760 </TT></FONT><BR><FONT=20
  size=3D2><TT>&gt; -----Original Message-----<BR>&gt; From:=20
  w3c-dist-auth-request@w3.org =
[mailto:w3c-dist-auth-request@w3.org]<BR>&gt; On=20
  Behalf Of Geoffrey M Clemm<BR>&gt; Sent: Friday, September 19, 2003 =
3:19=20
  PM<BR>&gt; To: w3c-dist-auth@w3.org<BR>&gt; Subject: RE: ACL and=20
  lockdiscovery<BR></TT></FONT><BR><FONT size=3D2><TT>&gt; <BR>&gt; If =
the client=20
  doesn't have permission to do an UNLOCK, <BR>&gt; or if the lock =
automatically=20
  times out <BR>&gt; (the two use cases identified where the server is =
likely to=20
  withhold <BR>&gt; the lock token), the client either cannot do an =
UNLOCK, or=20
  does not <BR>&gt; need to do an UNLOCK. <BR>&gt; <BR>&gt; WRT clients =
that do=20
  not store the lock tokens, but rather try to steal <BR>&gt; any lock =
token=20
  that is allowed by access control, this violates the whole <BR>&gt; =
point of=20
  having lock tokens instead of just a server-side lock =
(i.e.preventing<BR>&gt;=20
  two clients working on behalf of the same user from stomping on each =
other),=20
  <BR>&gt; and such a client should be fixed, not catered to by servers. =

  <BR>&gt; <BR>&gt; Cheers, <BR>&gt; Geoff <BR>&gt; <BR>&gt; "Lisa =
Dusseault"=20
  &lt;lisa@xythos.com&gt; wrote on 09/18/2003 12:32:20 PM:<BR>&gt; =
<BR>&gt; &gt;=20
  Unfortunately, withholding the locktoken from the client that <BR>&gt; =
&gt;=20
  requested that lock <BR>&gt; &gt; would break UNLOCK for some clients =
that=20
  don't store their own lock tokens.<BR>&gt; &gt; Those clients might =
show error=20
  messages &amp; cause support calls. <BR>&gt; &gt; Thus, as a matter of =

  interoperability, a server would at least have to <BR>&gt; &gt; be =
careful in=20
  providing incomplete information in lockdiscovery. <BR>&gt; &gt; =
&nbsp;=20
  <BR>&gt; &gt; This area is murkier than I had thought. &nbsp;Should =
there be a=20
  clarification in<BR>&gt; &gt; RFC2518bis? It would obviously be easier =
to=20
  write interoperable clients <BR>&gt; &gt; if all servers had to behave =
the=20
  same in this area. &nbsp;Is there a de facto <BR>&gt; &gt; minimum =
standard=20
  here that we can clarify in the next rev? <BR>&gt; &gt; &nbsp; =
<BR>&gt; &gt;=20
  lisa <BR>&gt; &gt; -----Original Message-----<BR>&gt; &gt; From:=20
  w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org] =
<BR>&gt;=20
  &gt; On Behalf Of Geoffrey M Clemm<BR>&gt; &gt; Sent: Thursday, =
September 18,=20
  2003 5:17 AM<BR>&gt; &gt; To: w3c-dist-auth@w3.org<BR>&gt; &gt; =
Subject: RE:=20
  ACL and lockdiscovery<BR>&gt; <BR>&gt; &gt; <BR>&gt; &gt; That is not =
correct.=20
  &nbsp;RFC-2518 explicitly states in <BR>&gt; &gt; section 13.8 (where =
the=20
  DAV:lockdiscovery property is defined): <BR>&gt; &gt; <BR>&gt; &gt; =
"The=20
  server is free to withhold any or all of this information <BR>&gt; =
&gt; if the=20
  requesting principal does not have sufficient access rights <BR>&gt; =
&gt; to=20
  see the requested data." <BR>&gt; &gt; <BR>&gt; &gt; In particular, if =
the=20
  client does not have sufficient access <BR>&gt; &gt; rights to UNLOCK =
the=20
  resource, a server could very reasonably <BR>&gt; &gt; choose to hide =
the=20
  lock-token information. <BR>&gt; &gt; <BR>&gt; &gt; In addition, a =
server for=20
  which locks have a reasonably <BR>&gt; &gt; short maximum expiration =
may chose=20
  to never expose the lock tokens <BR>&gt; &gt; (i.e. nobody has =
sufficient=20
  access rights to see the lock tokens). <BR>&gt; &gt; <BR>&gt; &gt; =
Cheers,=20
  <BR>&gt; &gt; Geoff <BR>&gt; &gt; <BR>&gt; &gt; =
w3c-dist-auth-request@w3.org=20
  wrote on 09/17/2003 07:49:20 PM:<BR>&gt; &gt; <BR>&gt; &gt; &gt; =
<BR>&gt; &gt;=20
  &gt; I'd also point out that the lockdiscovery property MUST =
contain<BR>&gt;=20
  &gt; &gt; all the lock tokens, regardless of access control settings.=20
  &nbsp;This<BR>&gt; &gt; &gt; is not considered a security leak, =
because=20
  authorization is also<BR>&gt; &gt; &gt; needed to use a lock token. =
&nbsp;So=20
  this is the server logic to apply<BR>&gt; &gt; &gt; whenever the =
client=20
  provides a lock token: <BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; Is this =
the same=20
  authorization context that took out the lock? <BR>&gt; &gt; &gt; =
&nbsp; Yes=20
  {<BR>&gt; &gt; &gt; &nbsp; &nbsp;Allow the operation normally, =
provided the=20
  operation is <BR>&gt; &gt; &gt; &nbsp; &nbsp;allowed, and provided the =
lock=20
  token is correct and all<BR>&gt; &gt; &gt; &nbsp; &nbsp;required lock =
tokens=20
  are provided, etc.<BR>&gt; &gt; &gt; &nbsp; } No {<BR>&gt; &gt; &gt; =
&nbsp;=20
  &nbsp;Is this an UNLOCK operation, with an authorization that<BR>&gt; =
&gt;=20
  &gt; &nbsp; &nbsp;includes permission to delete others' locks?<BR>&gt; =
&gt;=20
  &gt; &nbsp; &nbsp;Yes {<BR>&gt; &gt; &gt; &nbsp; &nbsp; &nbsp; perform =

  UNLOCK<BR>&gt; &gt; &gt; &nbsp; &nbsp;} No {<BR>&gt; &gt; &gt; &nbsp; =
&nbsp;=20
  &nbsp; Fail request<BR>&gt; &gt; &gt; &nbsp; &nbsp;}<BR>&gt; &gt; &gt; =
&nbsp;=20
  }<BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; Lisa<BR>&gt; &gt; &gt; <BR>&gt; =
&gt;=20
  &gt; &gt; -----Original Message-----<BR>&gt; &gt; &gt; &gt; From:=20
  w3c-dist-auth-request@w3.org <BR>&gt; &gt; &gt; &gt;=20
  [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar<BR>&gt; =
&gt;=20
  &gt; &gt; Sent: Wednesday, September 17, 2003 11:17 AM<BR>&gt; &gt; =
&gt; &gt;=20
  To: 'Horst Liermann'; w3c-dist-auth@w3.org<BR>&gt; &gt; &gt; &gt; =
Subject: RE:=20
  ACL and lockdiscovery<BR>&gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; =
<BR>&gt;=20
  &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; The ACL spec hasn't defined a =
privilege=20
  specifically to <BR>&gt; &gt; &gt; &gt; control read access to the=20
  lockdiscovery property, or even a <BR>&gt; &gt; &gt; &gt; privilege to =
control=20
  access to all the privileges in total. &nbsp;<BR>&gt; &gt; &gt; &gt; =
An=20
  individual server implementation could provide such a <BR>&gt; &gt; =
&gt; &gt;=20
  privilege and aggregate it under &lt;dav:read&gt;, but this isn't=20
  required.<BR>&gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; =
--Eric<BR>&gt; &gt;=20
  &gt; &gt; <BR>&gt; &gt; &gt; &gt; &gt; -----Original =
Message-----<BR>&gt; &gt;=20
  &gt; &gt; &gt; From: w3c-dist-auth-request@w3.org <BR>&gt; &gt; &gt; =
&gt; &gt;=20
  [mailto:w3c-dist-auth-request@w3.org]<BR>&gt; &gt; &gt; &gt; &gt; On =
Behalf Of=20
  Horst Liermann<BR>&gt; &gt; &gt; &gt; &gt; Sent: Wednesday, September =
17, 2003=20
  10:08 AM<BR>&gt; &gt; &gt; &gt; &gt; To: =
'w3c-dist-auth@w3.org'<BR>&gt; &gt;=20
  &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; =
&gt; Hi=20
  all,<BR>&gt; &gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; &gt; some =
questions=20
  about lockdiscovery and ACL's<BR>&gt; &gt; &gt; &gt; &gt; <BR>&gt; =
&gt; &gt;=20
  &gt; &gt; Suppose, you have a server with WebDAV ( including lock) and =
it=20
  <BR>&gt; &gt; &gt; &gt; &gt; support's ACL. What is the behavior for=20
  lockdiscovery, can <BR>&gt; &gt; &gt; &gt; I see all <BR>&gt; &gt; =
&gt; &gt;=20
  &gt; lock token or am I only allowed to see the tokens where I =
<BR>&gt; &gt;=20
  &gt; &gt; am the owner <BR>&gt; &gt; &gt; &gt; &gt; of the lock ? As =
far as I=20
  understand, lockdiscovery reports <BR>&gt; &gt; &gt; &gt; all locks. =
<BR>&gt;=20
  &gt; &gt; &gt; &gt; Is this a security leak ?<BR>&gt; &gt; &gt; &gt; =
&gt;=20
  <BR>&gt; &gt; &gt; &gt; &gt; Best Regards<BR>&gt; &gt; &gt; &gt; &gt; =
&nbsp;=20
  &nbsp;Horst<BR>&gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; <BR>&gt; =
&gt; &gt;=20
  &gt; <BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt;=20
</TT></FONT></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_015C_01C37ED9.5367CB20--



From w3c-dist-auth-request@w3.org  Fri Sep 19 12:36:09 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12272
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 12:36:08 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 5BB29A0664; Fri, 19 Sep 2003 12:35:52 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 290E2A068E
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 12:35:48 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id F358B1429A; Fri, 19 Sep 2003 12:35:47 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from e1.ny.us.ibm.com (e1.ny.us.ibm.com [32.97.182.101])
	by dr-nick.w3.org (Postfix) with ESMTP id C871D14293
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 12:35:47 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e1.ny.us.ibm.com (8.12.10/NS PXFA) with ESMTP id h8JGZlPF258424
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 12:35:47 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h8JGZjOu202382
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 12:35:46 -0400
In-Reply-To: <JIEGINCHMLABHJBIGKBCIEGDIIAA.julian.reschke@gmx.de>
To: "'WebDAV List (E-mail)'" <w3c-dist-auth@w3.org>
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Message-ID: <OF47E54395.BE099420-ON85256DA6.00587FD0-85256DA6.005B248B@us.ibm.com>
Date: Fri, 19 Sep 2003 12:35:30 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/19/2003 12:35:46,
	Serialize complete at 09/19/2003 12:35:46
Content-Type: multipart/alternative; boundary="=_alternative 005B1A5A85256DA6_="
Subject: RE: multiple "source" properties documents
X-Archived-At: http://www.w3.org/mid/OF47E54395.BE099420-ON85256DA6.00587FD0-85256DA6.005B248B@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7892
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919163552.5BB29A0664@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 12:35:52 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 005B1A5A85256DA6_=
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: base64

SSBkb24ndCB0aGluayB0aGUgZm9ybWF0IG5lZWRzIHRvIGJlIGNoYW5nZWQsIGJ1dCBpdCBjZXJ0
YWlubHkNCndvdWxkIG5lZWQgdG8gYmUgbW9yZSBjbGVhcmx5IGRlc2NyaWJlZC4gIEkgYW0gY29u
dGludWFsbHkNCmFtYXplZCBhdCBob3cgc3VjaCBhbiBvdGhlcndpc2Ugc2Vuc2libGUgZ3JvdXAg
b2YgYXV0aG9ycyBjb3VsZCBoYXZlDQpjaG9zZW4gYSBub2RlIG5hbWVkIERBVjp0Z3QgdG8gaG9s
ZCB0aGUgVVJJIG9mIHRoZSBzb3VyY2UsDQphbmQgYSBub2RlIG5hbWVkIERBVjpzcmMgdG8gaG9s
ZCB0aGUgVVJJIG9mIHdoYXQgaXMgdXN1YWxseSB0aGUNCnJlc291cmNlIGl0c2VsZi4gIERpZG4n
dCB0aGV5IGF0IGxpc3QgZmxpbmNoIG9yIGdyaW1hY2UgYXQNCnRoZSBzZW50ZW5jZXM6DQoNCiJU
aGUgZGVzdGluYXRpb24gb2YgdGhlIHNvdXJjZSBsaW5rIGlkZW50aWZpZXMgdGhlIC4uLiBzb3Vy
Y2UNCiBvZiB0aGUgbGlua+KAmXMgc291cmNlLiINCg0KYW5kDQoNCiJUaGUgc291cmNlIG9mIHRo
ZSBsaW5rIGlzIHR5cGljYWxseSB0aGUgVVJJIG9mIHRoZSByZXNvdXJjZQ0KIG9uIHdoaWNoIHRo
ZSBsaW5rIGlzIGRlZmluZWQuIg0KDQpPbmUgY291bGQgbWFrZSBhIGdvb2QgYXJndW1lbnQgdGhh
dCB0aGlzIHBvb3IgbmFtaW5nIGNob2ljZSBhbG9uZQ0KbWVyaXRzIGRlcHJlY2F0aW5nIHRoZSBm
ZWF0dXJlIDotKS4NCg0KQnV0IGJhY2sgdG8geW91ciBhY3R1YWwgcXVlc3Rpb24sIGlmIHRoZXJl
IGFyZSBtdWx0aXBsZSBvdXRwdXRzDQpvZiB0aGUgcHJvY2Vzc2luZyBzdGVwIChpLmUuIGl0IHBy
b2R1Y2VzIG5vdCBvbmx5IHRoZSByZXNvdXJjZQ0KaWRlbnRpZmllZCBieSB0aGUgcmVxdWVzdC1V
UkksIGJ1dCBzZXZlcmFsIG90aGVyIHJlc291cmNlcyksDQp0aGVuIGl0IGlzIHVzZWZ1bCB0byBo
YXZlIHRoZSBEQVY6c3JjIG5vZGVzIHRvIGluZGljYXRlIHdoYXQgDQp0aG9zZSBvdGhlciBvdXRw
dXQgcmVzb3VyY2VzIGFyZS4NCg0KQ2hlZXJzLA0KR2VvZmYNCg0KSnVsaWFuIHdyb3RlIG9uIDA5
LzE5LzIwMDMgMDk6MTg6MjkgQU06DQoNCj4gR2VvZmYsDQo+IA0KPiBwbGVhc2UgcmUtcmVhZCB0
aGUgb2xkIGRpc2N1c3Npb24gb24gdGhlIG1haWxpbmcgbGlzdC4gUkZDMjUxOCANCj4gc3BlY2lm
aWVzIGEgZm9ybWF0IHRoYXQgaW5kZWVkIGRvZXNuJ3QgbWFrZSBhbnkgc2Vuc2UgKGNhbiB5b3Ug
DQo+IGV4cGxhaW4gd2hhdCB0aGUgREFWOnNyYyBzdWItZWxlbWVudCBpcyBmb3I/KS4NCj4gDQo+
IFNvICppZiogdGhpcyBmZWF0dXJlIGlzIHRvIHJlbWFpbiBpbiBSRkMyNTE4LCBhdCBsZWFzdCB0
aGUgZm9ybWF0IA0KPiBuZWVkcyB0byBiZSBmaXhlZCAocG9zc2libHkgaW4gYSB3YXkgYmFja3dh
cmRzIGNvbXBhdGlibGUgdG8gUkZDMjUxOCkuDQo+IA0KPiBKdWxpYW4NCj4gLS0NCj4gPGdyZWVu
Lz5ieXRlcyBHbWJIIC0tIGh0dHA6Ly93d3cuZ3JlZW5ieXRlcy5kZSAtLSB0ZWw6KzQ5MjUxMjgw
Nzc2MCANCj4gLS0tLS1PcmlnaW5hbCBNZXNzYWdlLS0tLS0NCj4gRnJvbTogdzNjLWRpc3QtYXV0
aC1yZXF1ZXN0QHczLm9yZyBbbWFpbHRvOnczYy1kaXN0LWF1dGgtcmVxdWVzdEB3My5vcmddDQo+
IE9uIEJlaGFsZiBPZiBHZW9mZnJleSBNIENsZW1tDQo+IFNlbnQ6IEZyaWRheSwgU2VwdGVtYmVy
IDE5LCAyMDAzIDM6MDYgUE0NCj4gVG86ICdXZWJEQVYgTGlzdCAoRS1tYWlsKScNCj4gU3ViamVj
dDogUkU6IG11bHRpcGxlICJzb3VyY2UiIHByb3BlcnRpZXMgZG9jdW1lbnRzDQoNCj4gDQo+IE15
IHBlcnNwZWN0aXZlIGlzIGEgYml0IGRpZmZlcmVudC4gIFRoZSBEQVY6c291cmNlIHByb3BlcnR5
IA0KPiB3YXMgZGVzaWduZWQgZm9yIGV4YWN0bHkgdGhlIHNpdHVhdGlvbiB0aGF0IENvbmFsIGRl
c2NyaWJlcy4gDQo+IEhlJ2QgbGlrZSBhIGdlbmVyaWMgYXBwbGljYXRpb24gdG8gcG9wIHVwIHRo
ZSBsaXN0IG9mIFVSTCdzIA0KPiBhbmQgc2F5ICJ0aGVzZSBhcmUgdGhlIHNvdXJjZXMiLiAgVGhl
cmUgYXJlIG5vIHNpZ25pZmljYW50IA0KPiB0ZXN0aW5nIGlzc3VlcyAuLi4gdGhlIGZvcm1hdCBv
ZiB0aGUgREFWOnNvdXJjZSBwcm9wZXJ0eSBpcyANCj4gd2VsbCBkZWZpbmVkLCBhbmQgYWxsIGEg
Y2xpZW50IGlzIGV4cGVjdGVkIHRvIGRvIGlzIHRvIGV4cG9zZSANCj4gdGhlIHNwZWNpZmllZCBs
aXN0IG9mIFVSTCdzLiANCj4gDQo+IFNvIGluIENvbmFsJ3MgY2FzZSwgSSdkIGp1c3QgZXhwb3Nl
IHRoaXMgZmVhdHVyZSB1c2luZyB0aGUgDQo+IERBVjpzb3VyY2UgcHJvcGVydHksIGFuZCB5b3Ug
YXJlIG5vIHdvcnNlIG9mZiB0aGF0IGlmIHlvdSANCj4ganVzdCBkZWZpbmVkIHlvdXIgb3duIGN1
c3RvbSBwcm9wZXJ0eSwgYW5kIHRoYXQgaWYgZW5vdWdoIA0KPiBmb2xrcyBkbyBzbywgdGhlIHBy
b3BlcnR5IHdpbGwgYmVjb21lICJ1bmRlcHJlY2F0ZWQiLiANCj4gDQo+IE5vdGU6IEkgYW0gbm90
IGFyZ3VpbmcgYWdhaW5zdCBkZXByZWNhdGluZyB0aGUgREFWOnNvdXJjZSANCj4gZmVhdHVyZSAu
Li4gSSBkb24ndCB0aGluayB0aGUgdG9waWMgaXMgc2lnbmlmaWNhbnQgZW5vdWdoIA0KPiB0byBt
ZXJpdCBiZWluZyByZS1vcGVuZWQgLi4uIEknbSBqdXN0IHNheWluZyB0aGF0IGlmIHlvdSBhcmUg
DQo+IGFuIGltcGxlbWVudG9yIGFuZCBlbmNvdW50ZXIgYSB2YWxpZCB1c2UgZm9yIHRoZSBEQVY6
c291cmNlIA0KPiBwcm9wZXJ0eSwgeW91IHNob3VsZCBnbyBhaGVhZCBhbmQgdXNlIGl0IGluc3Rl
YWQgb2YgaW52ZW50aW5nIA0KPiB5b3VyIG93biBjdXN0b20gcHJvcGVydHksIGV2ZW4gaWYgaXQg
aXMgZGVwcmVjYXRlZCBpbiAyNTE4YmlzLiANCj4gDQo+IENoZWVycywgDQo+IEdlb2ZmIA0KPiAN
Cj4gDQo+IExpc2Egd3JvdGUgb24gMDkvMTgvMjAwMyAwNzo0MTo1NiBQTToNCj4gDQo+ID4gDQo+
ID4gDQo+ID4gPiBGcm9tIHdoYXQgSSByZWFkLCB0aGUgInNvdXJjZSIgcHJvcGVydHkgd2FzIGEg
Z3JlYXQgaWRlYSBidXQgDQo+ID4gPiBuby1vbmUgZXZlciBpbXBsZW1lbnRlZCBpdCwgc3VwcG9z
ZWRseSBiZWNhdXNlIGl0IHdhcyB0b28gDQo+ID4gPiBjb21wbGljYXRlZCBhbmQvb3IgdGhlcmUg
d2FzIG5vIHBlcmNlaXZlZCBuZWVkLiANCj4gPiANCj4gPiBJJ2QgY2hhcmFjdGVyaXplIHRoZSBy
ZWFzb25zIGEgbGl0dGxlIGRpZmZlcmVudGx5OiANCj4gPiAgMSkgVGhlIGZlYXR1cmUgd2FzIHVu
ZGVyc3BlY2lmaWVkLCB0aGVyZSB3YXMgbmV2ZXIgZW5vdWdoIA0KPiA+ICAgIGluZm9ybWF0aW9u
IGluIHRoZSBzcGVjIHRvIGJlIGFibGUgdG8gZnVsbHkgaW1wbGVtZW50DQo+ID4gICAgb3IgaW50
ZXJvcGVyYXRlDQo+ID4gIDIpIEltcGxlbWVudGF0aW9uIGludGVyZXN0IHdhcyBsb3cgLS0gd2Ug
YXNrZWQgYXJvdW5kIHRvIHNlZQ0KPiA+ICAgIHdobyBoYWQgaW1wbGVtZW50ZWQgdGhpcyBmZWF0
dXJlIGFuZCBnb3Qgbm8gcG9zaXRpdmUNCj4gPiAgICByZXNwb25zZXMgYXQgYWxsLg0KPiA+IA0K
PiA+ID4gRXZlbnR1YWxseSBpdCANCj4gPiA+IHdhcyBmb3JtYWxseSBkZXByZWNhdGVkLiBJcyB0
aGlzIGNvcnJlY3Q/IA0KPiA+IA0KPiA+IFRoZSBkZXByZWNhdGlvbiBpc24ndCBmaW5hbCB5ZXQs
IGJ1dCB3ZSBhcmUgcHJvcG9zaW5nIHRvIA0KPiA+IGRlcHJlY2F0ZSBpdC4NCj4gPiANCj4gPiA+
IEkndmUgYWxzbyByZWFkIG9mIA0KPiA+ID4gdGhlICJ0cmFuc2xhdGUiIGhlYWRlciwgd2hpY2gg
SSBnYXRoZXIgaXMgYSANCj4gPiA+IE1pY3Jvc29mdC1zcGVjaWZpYyBleHRlbnNpb24/IEkgYWxz
byBnYXRoZXIgdGhhdCB0aGlzIG9ubHkgDQo+ID4gPiBzdXBwb3J0cyBhIG9uZS10by1vbmUgbWFw
cGluZyBiZXR3ZWVuIGEgZG9jdW1lbnQgYW5kIGl0cyANCj4gPiA+IHNvdXJjZSwgaS5lLiBhIGRv
Y3VtZW50IGhhcyBvbmUgYW5kIG9ubHkgb25lIHNvdXJjZT8NCj4gPiANCj4gPiBZZXMNCj4gPiAN
Cj4gPiA+IE15IGNhc2UgaXMgdGhhdCBJIGhhdmUgYSBzZXJ2ZXIgd2hpY2ggZ2VuZXJhdGVzIHBh
Z2VzIGZyb20gDQo+ID4gPiBtdWx0aXBsZSBzb3VyY2VzIGFuZCBrZWVwcyB0cmFjayBvZiB0aG9z
ZSBzb3VyY2VzIGluIHN1Y2ggYSANCj4gPiA+IHdheSB0aGF0IGl0IGNvdWxkIGZhaXJseSBlYXNp
bHkgc3VwcG9ydCBkYXY6c291cmNlLiBJJ2QgbGlrZSANCj4gPiA+IGVkaXRvcnMgdG8gYmUgYWJs
ZSB0byBlZGl0IHRoZSBwYWdlIGFuZCBzZWxlY3Qgd2hpY2ggb2YgdGhlIA0KPiA+ID4gc291cmNl
IGRvY3VtZW50cyB0byBlZGl0LiBCdXQgYXJlIHRoZXJlIGV4aXN0aW5nIGNsaWVudHMgdGhhdCAN
Cj4gPiA+IHdpbGwgYWN0dWFsbHkgZG8gdGhhdD8gT3IgYXJlIHRoZXJlIG90aGVyIHdlYi1kYXYg
bWVjaGFuaXNtcyANCj4gPiA+IHRoYXQgbWlnaHQgc3VwcG9ydCBteSB1c2UtY2FzZT8NCj4gPiAN
Cj4gPiBOb3QgdGhhdCBJIGtub3cgb2YuICBZb3UnZCBiZSB0aGUgZmlyc3QgdG8gaW1wbGVtZW50
IGEgDQo+ID4gcHJvdG9jb2wgZmVhdHVyZSB0byBleHBvc2UgbXVsdGlwbGUgbWFwcGluZ3Mgc28g
bm9ib2R5DQo+ID4gdG8gaW50ZXJvcGVyYXRlIHdpdGggYW5kIG5vIHRvb2xzIHRvIHN1cHBvcnQg
eW91ciBmZWF0dXJlLg0KPiA+IA0KPiA+IElmIHRoZXJlIGlzIHN1ZmZpY2llbnQgaW50ZXJlc3Qg
ZnJvbSBpbXBsZW1lbnRvcnMgdG8gbWFrZQ0KPiA+IGZvcndhcmQgcHJvZ3Jlc3Mgb24gdGhpcywg
SSdkIHJlY29tbWVuZCBhIHNlcGFyYXRlIGRyYWZ0IHJhdGhlcg0KPiA+IHRoYW4gcmVzdXJyZWN0
IHRoZSB1bmltcGxlbWVudGVkLCB1bmRlcnNwZWNpZmllZCwgYW5kIHVudGVzdGVkDQo+ID4gZmVh
dHVyZSBpbiBSRkMyNTE4Lg0KPiA+IA0KPiA+IExpc2ENCj4gPiANCj4gPiANCg==
--=_alternative 005B1A5A85256DA6_=
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: base64

DQo8YnI+PGZvbnQgc2l6ZT0yPjx0dD5JIGRvbid0IHRoaW5rIHRoZSBmb3JtYXQgbmVlZHMgdG8g
YmUgY2hhbmdlZCwgYnV0DQppdCBjZXJ0YWlubHk8L3R0PjwvZm9udD4NCjxicj48Zm9udCBzaXpl
PTI+PHR0PndvdWxkIG5lZWQgdG8gYmUgbW9yZSBjbGVhcmx5IGRlc2NyaWJlZC4gJm5ic3A7SSBh
bQ0KY29udGludWFsbHk8L3R0PjwvZm9udD4NCjxicj48Zm9udCBzaXplPTI+PHR0PmFtYXplZCBh
dCBob3cgc3VjaCBhbiBvdGhlcndpc2Ugc2Vuc2libGUgZ3JvdXAgb2YNCmF1dGhvcnMgY291bGQg
aGF2ZTwvdHQ+PC9mb250Pg0KPGJyPjxmb250IHNpemU9Mj48dHQ+Y2hvc2VuIGEgbm9kZSBuYW1l
ZCBEQVY6dGd0IHRvIGhvbGQgdGhlIFVSSSBvZiB0aGUNCnNvdXJjZSw8L3R0PjwvZm9udD4NCjxi
cj48Zm9udCBzaXplPTI+PHR0PmFuZCBhIG5vZGUgbmFtZWQgREFWOnNyYyB0byBob2xkIHRoZSBV
Ukkgb2Ygd2hhdCBpcw0KdXN1YWxseSB0aGU8L3R0PjwvZm9udD4NCjxicj48Zm9udCBzaXplPTI+
PHR0PnJlc291cmNlIGl0c2VsZi4gJm5ic3A7RGlkbid0IHRoZXkgYXQgbGlzdCBmbGluY2gNCm9y
IGdyaW1hY2UgYXQ8L3R0PjwvZm9udD4NCjxicj48Zm9udCBzaXplPTI+PHR0PnRoZSBzZW50ZW5j
ZXM6PC90dD48L2ZvbnQ+DQo8YnI+DQo8YnI+PGZvbnQgc2l6ZT0yPjx0dD4mcXVvdDtUaGUgZGVz
dGluYXRpb24gb2YgdGhlIHNvdXJjZSBsaW5rIGlkZW50aWZpZXMNCnRoZSAuLi4gc291cmNlPC90
dD48L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yPjx0dD4mbmJzcDtvZiB0aGUgbGlua+KAmXMgc291
cmNlLiZxdW90OzwvdHQ+PC9mb250Pg0KPGJyPg0KPGJyPjxmb250IHNpemU9Mj48dHQ+YW5kPC90
dD48L2ZvbnQ+DQo8YnI+DQo8YnI+PGZvbnQgc2l6ZT0yPjx0dD4mcXVvdDtUaGUgc291cmNlIG9m
IHRoZSBsaW5rIGlzIHR5cGljYWxseSB0aGUgVVJJDQpvZiB0aGUgcmVzb3VyY2U8L3R0PjwvZm9u
dD4NCjxicj48Zm9udCBzaXplPTI+PHR0PiZuYnNwO29uIHdoaWNoIHRoZSBsaW5rIGlzIGRlZmlu
ZWQuJnF1b3Q7PC90dD48L2ZvbnQ+DQo8YnI+DQo8YnI+PGZvbnQgc2l6ZT0yPjx0dD5PbmUgY291
bGQgbWFrZSBhIGdvb2QgYXJndW1lbnQgdGhhdCB0aGlzIHBvb3IgbmFtaW5nDQpjaG9pY2UgYWxv
bmU8L3R0PjwvZm9udD4NCjxicj48Zm9udCBzaXplPTI+PHR0Pm1lcml0cyBkZXByZWNhdGluZyB0
aGUgZmVhdHVyZSA6LSkuPC90dD48L2ZvbnQ+DQo8YnI+DQo8YnI+PGZvbnQgc2l6ZT0yPjx0dD5C
dXQgYmFjayB0byB5b3VyIGFjdHVhbCBxdWVzdGlvbiwgaWYgdGhlcmUgYXJlIG11bHRpcGxlDQpv
dXRwdXRzPC90dD48L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0yPjx0dD5vZiB0aGUgcHJvY2Vzc2lu
ZyBzdGVwIChpLmUuIGl0IHByb2R1Y2VzIG5vdCBvbmx5DQp0aGUgcmVzb3VyY2U8L3R0PjwvZm9u
dD4NCjxicj48Zm9udCBzaXplPTI+PHR0PmlkZW50aWZpZWQgYnkgdGhlIHJlcXVlc3QtVVJJLCBi
dXQgc2V2ZXJhbCBvdGhlciByZXNvdXJjZXMpLDwvdHQ+PC9mb250Pg0KPGJyPjxmb250IHNpemU9
Mj48dHQ+dGhlbiBpdCBpcyB1c2VmdWwgdG8gaGF2ZSB0aGUgREFWOnNyYyBub2RlcyB0byBpbmRp
Y2F0ZQ0Kd2hhdCA8L3R0PjwvZm9udD4NCjxicj48Zm9udCBzaXplPTI+PHR0PnRob3NlIG90aGVy
IG91dHB1dCByZXNvdXJjZXMgYXJlLjwvdHQ+PC9mb250Pg0KPGJyPg0KPGJyPjxmb250IHNpemU9
Mj48dHQ+Q2hlZXJzLDwvdHQ+PC9mb250Pg0KPGJyPjxmb250IHNpemU9Mj48dHQ+R2VvZmY8L3R0
PjwvZm9udD4NCjxicj4NCjxicj48Zm9udCBzaXplPTI+PHR0Pkp1bGlhbiB3cm90ZSBvbiAwOS8x
OS8yMDAzIDA5OjE4OjI5IEFNOjxicj4NCjxicj4NCiZndDsgR2VvZmYsPC90dD48L2ZvbnQ+DQo8
YnI+PGZvbnQgc2l6ZT0yPjx0dD4mZ3Q7ICZuYnNwOzwvdHQ+PC9mb250Pg0KPGJyPjxmb250IHNp
emU9Mj48dHQ+Jmd0OyBwbGVhc2UgcmUtcmVhZCB0aGUgb2xkIGRpc2N1c3Npb24gb24gdGhlIG1h
aWxpbmcNCmxpc3QuIFJGQzI1MTggPGJyPg0KJmd0OyBzcGVjaWZpZXMgYSBmb3JtYXQgdGhhdCBp
bmRlZWQgZG9lc24ndCBtYWtlIGFueSBzZW5zZSAoY2FuIHlvdSA8YnI+DQomZ3Q7IGV4cGxhaW4g
d2hhdCB0aGUgREFWOnNyYyBzdWItZWxlbWVudCBpcyBmb3I/KS48L3R0PjwvZm9udD4NCjxicj48
Zm9udCBzaXplPTI+PHR0PiZndDsgJm5ic3A7PC90dD48L2ZvbnQ+DQo8YnI+PGZvbnQgc2l6ZT0y
Pjx0dD4mZ3Q7IFNvICppZiogdGhpcyBmZWF0dXJlIGlzIHRvIHJlbWFpbiBpbiBSRkMyNTE4LA0K
YXQgbGVhc3QgdGhlIGZvcm1hdCA8YnI+DQomZ3Q7IG5lZWRzIHRvIGJlIGZpeGVkIChwb3NzaWJs
eSBpbiBhIHdheSBiYWNrd2FyZHMgY29tcGF0aWJsZSB0byBSRkMyNTE4KS48L3R0PjwvZm9udD4N
Cjxicj48Zm9udCBzaXplPTI+PHR0PiZndDsgJm5ic3A7PC90dD48L2ZvbnQ+DQo8YnI+PGZvbnQg
c2l6ZT0yPjx0dD4mZ3Q7IEp1bGlhbjwvdHQ+PC9mb250Pg0KPGJyPjxmb250IHNpemU9Mj48dHQ+
Jmd0OyAtLTxicj4NCiZndDsgJmx0O2dyZWVuLyZndDtieXRlcyBHbWJIIC0tIGh0dHA6Ly93d3cu
Z3JlZW5ieXRlcy5kZSAtLSB0ZWw6KzQ5MjUxMjgwNzc2MA0KPC90dD48L2ZvbnQ+DQo8YnI+PGZv
bnQgc2l6ZT0yPjx0dD4mZ3Q7IC0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tPGJyPg0KJmd0OyBG
cm9tOiB3M2MtZGlzdC1hdXRoLXJlcXVlc3RAdzMub3JnIFttYWlsdG86dzNjLWRpc3QtYXV0aC1y
ZXF1ZXN0QHczLm9yZ108YnI+DQomZ3Q7IE9uIEJlaGFsZiBPZiBHZW9mZnJleSBNIENsZW1tPGJy
Pg0KJmd0OyBTZW50OiBGcmlkYXksIFNlcHRlbWJlciAxOSwgMjAwMyAzOjA2IFBNPGJyPg0KJmd0
OyBUbzogJ1dlYkRBViBMaXN0IChFLW1haWwpJzxicj4NCiZndDsgU3ViamVjdDogUkU6IG11bHRp
cGxlICZxdW90O3NvdXJjZSZxdW90OyBwcm9wZXJ0aWVzIGRvY3VtZW50czxicj4NCjwvdHQ+PC9m
b250Pg0KPGJyPjxmb250IHNpemU9Mj48dHQ+Jmd0OyA8YnI+DQomZ3Q7IE15IHBlcnNwZWN0aXZl
IGlzIGEgYml0IGRpZmZlcmVudC4gJm5ic3A7VGhlIERBVjpzb3VyY2UgcHJvcGVydHkgPGJyPg0K
Jmd0OyB3YXMgZGVzaWduZWQgZm9yIGV4YWN0bHkgdGhlIHNpdHVhdGlvbiB0aGF0IENvbmFsIGRl
c2NyaWJlcy4gPGJyPg0KJmd0OyBIZSdkIGxpa2UgYSBnZW5lcmljIGFwcGxpY2F0aW9uIHRvIHBv
cCB1cCB0aGUgbGlzdCBvZiBVUkwncyA8YnI+DQomZ3Q7IGFuZCBzYXkgJnF1b3Q7dGhlc2UgYXJl
IHRoZSBzb3VyY2VzJnF1b3Q7LiAmbmJzcDtUaGVyZSBhcmUgbm8gc2lnbmlmaWNhbnQNCjxicj4N
CiZndDsgdGVzdGluZyBpc3N1ZXMgLi4uIHRoZSBmb3JtYXQgb2YgdGhlIERBVjpzb3VyY2UgcHJv
cGVydHkgaXMgPGJyPg0KJmd0OyB3ZWxsIGRlZmluZWQsIGFuZCBhbGwgYSBjbGllbnQgaXMgZXhw
ZWN0ZWQgdG8gZG8gaXMgdG8gZXhwb3NlIDxicj4NCiZndDsgdGhlIHNwZWNpZmllZCBsaXN0IG9m
IFVSTCdzLiA8YnI+DQomZ3Q7IDxicj4NCiZndDsgU28gaW4gQ29uYWwncyBjYXNlLCBJJ2QganVz
dCBleHBvc2UgdGhpcyBmZWF0dXJlIHVzaW5nIHRoZSA8YnI+DQomZ3Q7IERBVjpzb3VyY2UgcHJv
cGVydHksIGFuZCB5b3UgYXJlIG5vIHdvcnNlIG9mZiB0aGF0IGlmIHlvdSA8YnI+DQomZ3Q7IGp1
c3QgZGVmaW5lZCB5b3VyIG93biBjdXN0b20gcHJvcGVydHksIGFuZCB0aGF0IGlmIGVub3VnaCA8
YnI+DQomZ3Q7IGZvbGtzIGRvIHNvLCB0aGUgcHJvcGVydHkgd2lsbCBiZWNvbWUgJnF1b3Q7dW5k
ZXByZWNhdGVkJnF1b3Q7LiA8YnI+DQomZ3Q7IDxicj4NCiZndDsgTm90ZTogSSBhbSBub3QgYXJn
dWluZyBhZ2FpbnN0IGRlcHJlY2F0aW5nIHRoZSBEQVY6c291cmNlIDxicj4NCiZndDsgZmVhdHVy
ZSAuLi4gSSBkb24ndCB0aGluayB0aGUgdG9waWMgaXMgc2lnbmlmaWNhbnQgZW5vdWdoIDxicj4N
CiZndDsgdG8gbWVyaXQgYmVpbmcgcmUtb3BlbmVkIC4uLiBJJ20ganVzdCBzYXlpbmcgdGhhdCBp
ZiB5b3UgYXJlIDxicj4NCiZndDsgYW4gaW1wbGVtZW50b3IgYW5kIGVuY291bnRlciBhIHZhbGlk
IHVzZSBmb3IgdGhlIERBVjpzb3VyY2UgPGJyPg0KJmd0OyBwcm9wZXJ0eSwgeW91IHNob3VsZCBn
byBhaGVhZCBhbmQgdXNlIGl0IGluc3RlYWQgb2YgaW52ZW50aW5nIDxicj4NCiZndDsgeW91ciBv
d24gY3VzdG9tIHByb3BlcnR5LCBldmVuIGlmIGl0IGlzIGRlcHJlY2F0ZWQgaW4gMjUxOGJpcy4g
PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IENoZWVycywgPGJyPg0KJmd0OyBHZW9mZiA8YnI+DQomZ3Q7
IDxicj4NCiZndDsgPGJyPg0KJmd0OyBMaXNhIHdyb3RlIG9uIDA5LzE4LzIwMDMgMDc6NDE6NTYg
UE06PGJyPg0KJmd0OyA8YnI+DQomZ3Q7ICZndDsgPGJyPg0KJmd0OyAmZ3Q7IDxicj4NCiZndDsg
Jmd0OyAmZ3Q7IEZyb20gd2hhdCBJIHJlYWQsIHRoZSAmcXVvdDtzb3VyY2UmcXVvdDsgcHJvcGVy
dHkgd2FzIGENCmdyZWF0IGlkZWEgYnV0IDxicj4NCiZndDsgJmd0OyAmZ3Q7IG5vLW9uZSBldmVy
IGltcGxlbWVudGVkIGl0LCBzdXBwb3NlZGx5IGJlY2F1c2UgaXQgd2FzIHRvbw0KPGJyPg0KJmd0
OyAmZ3Q7ICZndDsgY29tcGxpY2F0ZWQgYW5kL29yIHRoZXJlIHdhcyBubyBwZXJjZWl2ZWQgbmVl
ZC4gPGJyPg0KJmd0OyAmZ3Q7IDxicj4NCiZndDsgJmd0OyBJJ2QgY2hhcmFjdGVyaXplIHRoZSBy
ZWFzb25zIGEgbGl0dGxlIGRpZmZlcmVudGx5OiA8YnI+DQomZ3Q7ICZndDsgJm5ic3A7MSkgVGhl
IGZlYXR1cmUgd2FzIHVuZGVyc3BlY2lmaWVkLCB0aGVyZSB3YXMgbmV2ZXIgZW5vdWdoDQo8YnI+
DQomZ3Q7ICZndDsgJm5ic3A7ICZuYnNwO2luZm9ybWF0aW9uIGluIHRoZSBzcGVjIHRvIGJlIGFi
bGUgdG8gZnVsbHkgaW1wbGVtZW50PGJyPg0KJmd0OyAmZ3Q7ICZuYnNwOyAmbmJzcDtvciBpbnRl
cm9wZXJhdGU8YnI+DQomZ3Q7ICZndDsgJm5ic3A7MikgSW1wbGVtZW50YXRpb24gaW50ZXJlc3Qg
d2FzIGxvdyAtLSB3ZSBhc2tlZCBhcm91bmQgdG8NCnNlZTxicj4NCiZndDsgJmd0OyAmbmJzcDsg
Jm5ic3A7d2hvIGhhZCBpbXBsZW1lbnRlZCB0aGlzIGZlYXR1cmUgYW5kIGdvdCBubyBwb3NpdGl2
ZTxicj4NCiZndDsgJmd0OyAmbmJzcDsgJm5ic3A7cmVzcG9uc2VzIGF0IGFsbC48YnI+DQomZ3Q7
ICZndDsgPGJyPg0KJmd0OyAmZ3Q7ICZndDsgRXZlbnR1YWxseSBpdCA8YnI+DQomZ3Q7ICZndDsg
Jmd0OyB3YXMgZm9ybWFsbHkgZGVwcmVjYXRlZC4gSXMgdGhpcyBjb3JyZWN0PyA8YnI+DQomZ3Q7
ICZndDsgPGJyPg0KJmd0OyAmZ3Q7IFRoZSBkZXByZWNhdGlvbiBpc24ndCBmaW5hbCB5ZXQsIGJ1
dCB3ZSBhcmUgcHJvcG9zaW5nIHRvIDxicj4NCiZndDsgJmd0OyBkZXByZWNhdGUgaXQuPGJyPg0K
Jmd0OyAmZ3Q7IDxicj4NCiZndDsgJmd0OyAmZ3Q7IEkndmUgYWxzbyByZWFkIG9mIDxicj4NCiZn
dDsgJmd0OyAmZ3Q7IHRoZSAmcXVvdDt0cmFuc2xhdGUmcXVvdDsgaGVhZGVyLCB3aGljaCBJIGdh
dGhlciBpcyBhIDxicj4NCiZndDsgJmd0OyAmZ3Q7IE1pY3Jvc29mdC1zcGVjaWZpYyBleHRlbnNp
b24/IEkgYWxzbyBnYXRoZXIgdGhhdCB0aGlzIG9ubHkNCjxicj4NCiZndDsgJmd0OyAmZ3Q7IHN1
cHBvcnRzIGEgb25lLXRvLW9uZSBtYXBwaW5nIGJldHdlZW4gYSBkb2N1bWVudCBhbmQgaXRzDQo8
YnI+DQomZ3Q7ICZndDsgJmd0OyBzb3VyY2UsIGkuZS4gYSBkb2N1bWVudCBoYXMgb25lIGFuZCBv
bmx5IG9uZSBzb3VyY2U/PGJyPg0KJmd0OyAmZ3Q7IDxicj4NCiZndDsgJmd0OyBZZXM8YnI+DQom
Z3Q7ICZndDsgPGJyPg0KJmd0OyAmZ3Q7ICZndDsgTXkgY2FzZSBpcyB0aGF0IEkgaGF2ZSBhIHNl
cnZlciB3aGljaCBnZW5lcmF0ZXMgcGFnZXMgZnJvbQ0KPGJyPg0KJmd0OyAmZ3Q7ICZndDsgbXVs
dGlwbGUgc291cmNlcyBhbmQga2VlcHMgdHJhY2sgb2YgdGhvc2Ugc291cmNlcyBpbiBzdWNoDQph
IDxicj4NCiZndDsgJmd0OyAmZ3Q7IHdheSB0aGF0IGl0IGNvdWxkIGZhaXJseSBlYXNpbHkgc3Vw
cG9ydCBkYXY6c291cmNlLiBJJ2QNCmxpa2UgPGJyPg0KJmd0OyAmZ3Q7ICZndDsgZWRpdG9ycyB0
byBiZSBhYmxlIHRvIGVkaXQgdGhlIHBhZ2UgYW5kIHNlbGVjdCB3aGljaCBvZg0KdGhlIDxicj4N
CiZndDsgJmd0OyAmZ3Q7IHNvdXJjZSBkb2N1bWVudHMgdG8gZWRpdC4gQnV0IGFyZSB0aGVyZSBl
eGlzdGluZyBjbGllbnRzDQp0aGF0IDxicj4NCiZndDsgJmd0OyAmZ3Q7IHdpbGwgYWN0dWFsbHkg
ZG8gdGhhdD8gT3IgYXJlIHRoZXJlIG90aGVyIHdlYi1kYXYgbWVjaGFuaXNtcw0KPGJyPg0KJmd0
OyAmZ3Q7ICZndDsgdGhhdCBtaWdodCBzdXBwb3J0IG15IHVzZS1jYXNlPzxicj4NCiZndDsgJmd0
OyA8YnI+DQomZ3Q7ICZndDsgTm90IHRoYXQgSSBrbm93IG9mLiAmbmJzcDtZb3UnZCBiZSB0aGUg
Zmlyc3QgdG8gaW1wbGVtZW50IGEgPGJyPg0KJmd0OyAmZ3Q7IHByb3RvY29sIGZlYXR1cmUgdG8g
ZXhwb3NlIG11bHRpcGxlIG1hcHBpbmdzIHNvIG5vYm9keTxicj4NCiZndDsgJmd0OyB0byBpbnRl
cm9wZXJhdGUgd2l0aCBhbmQgbm8gdG9vbHMgdG8gc3VwcG9ydCB5b3VyIGZlYXR1cmUuPGJyPg0K
Jmd0OyAmZ3Q7IDxicj4NCiZndDsgJmd0OyBJZiB0aGVyZSBpcyBzdWZmaWNpZW50IGludGVyZXN0
IGZyb20gaW1wbGVtZW50b3JzIHRvIG1ha2U8YnI+DQomZ3Q7ICZndDsgZm9yd2FyZCBwcm9ncmVz
cyBvbiB0aGlzLCBJJ2QgcmVjb21tZW5kIGEgc2VwYXJhdGUgZHJhZnQgcmF0aGVyPGJyPg0KJmd0
OyAmZ3Q7IHRoYW4gcmVzdXJyZWN0IHRoZSB1bmltcGxlbWVudGVkLCB1bmRlcnNwZWNpZmllZCwg
YW5kIHVudGVzdGVkPGJyPg0KJmd0OyAmZ3Q7IGZlYXR1cmUgaW4gUkZDMjUxOC48YnI+DQomZ3Q7
ICZndDsgPGJyPg0KJmd0OyAmZ3Q7IExpc2E8YnI+DQomZ3Q7ICZndDsgPGJyPg0KJmd0OyAmZ3Q7
IDwvdHQ+PC9mb250Pg0K
--=_alternative 005B1A5A85256DA6_=--



From w3c-dist-auth-request@w3.org  Fri Sep 19 12:36:45 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA00998
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 11:33:11 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 86629A0E2E; Fri, 19 Sep 2003 09:27:00 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 5B382A0737
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 09:26:54 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id D68D513E21; Fri, 19 Sep 2003 09:26:53 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (mail.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 3A30D13DCE
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:26:53 -0400 (EDT)
Received: (qmail 31179 invoked by uid 65534); 19 Sep 2003 13:26:51 -0000
Received: from unknown (HELO lisa) (217.5.201.10)
  by mail.gmx.net (mp023) with SMTP; 19 Sep 2003 15:26:51 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Geoffrey M Clemm" <geoffrey.clemm@us.ibm.com>, <w3c-dist-auth@w3.org>
Date: Fri, 19 Sep 2003 15:26:50 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCEEGEIIAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_00EE_01C37EC2.72B95690"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
In-reply-to: <OFC555C2D1.B14F1A5E-ON85256DA6.00481CCF-85256DA6.00491E8B@us.ibm.com>
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCEEGEIIAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7889
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919132700.86629A0E2E@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 09:27:00 -0400 (EDT)


This is a multi-part message in MIME format.

------=_NextPart_000_00EE_01C37EC2.72B95690
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

I basically agree with Geoff.

However there's the legitamite use case that a UI needs to get the active
locks just in order to be able to display whether a resource is locked or
not. So maybe we should think of a way that handles this case, without
having to reveal "too much".

Julian
--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

  -----Original Message-----
  From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]On
Behalf Of Geoffrey M Clemm
  Sent: Friday, September 19, 2003 3:19 PM
  To: w3c-dist-auth@w3.org
  Subject: RE: ACL and lockdiscovery



  If the client doesn't have permission to do an UNLOCK,
  or if the lock automatically times out
  (the two use cases identified where the server is likely to withhold
  the lock token), the client either cannot do an UNLOCK, or does not
  need to do an UNLOCK.

  WRT clients that do not store the lock tokens, but rather try to steal
  any lock token that is allowed by access control, this violates the whole
  point of having lock tokens instead of just a server-side lock (i.e.
preventing
  two clients working on behalf of the same user from stomping on each
other),
  and such a client should be fixed, not catered to by servers.

  Cheers,
  Geoff

  "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003 12:32:20 PM:

  > Unfortunately, withholding the locktoken from the client that
  > requested that lock
  > would break UNLOCK for some clients that don't store their own lock
tokens.
  > Those clients might show error messages & cause support calls.
  > Thus, as a matter of interoperability, a server would at least have to
  > be careful in providing incomplete information in lockdiscovery.
  >
  > This area is murkier than I had thought.  Should there be a
clarification in
  > RFC2518bis? It would obviously be easier to write interoperable clients
  > if all servers had to behave the same in this area.  Is there a de facto
  > minimum standard here that we can clarify in the next rev?
  >
  > lisa
  > -----Original Message-----
  > From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]
  > On Behalf Of Geoffrey M Clemm
  > Sent: Thursday, September 18, 2003 5:17 AM
  > To: w3c-dist-auth@w3.org
  > Subject: RE: ACL and lockdiscovery

  >
  > That is not correct.  RFC-2518 explicitly states in
  > section 13.8 (where the DAV:lockdiscovery property is defined):
  >
  > "The server is free to withhold any or all of this information
  > if the requesting principal does not have sufficient access rights
  > to see the requested data."
  >
  > In particular, if the client does not have sufficient access
  > rights to UNLOCK the resource, a server could very reasonably
  > choose to hide the lock-token information.
  >
  > In addition, a server for which locks have a reasonably
  > short maximum expiration may chose to never expose the lock tokens
  > (i.e. nobody has sufficient access rights to see the lock tokens).
  >
  > Cheers,
  > Geoff
  >
  > w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
  >
  > >
  > > I'd also point out that the lockdiscovery property MUST contain
  > > all the lock tokens, regardless of access control settings.  This
  > > is not considered a security leak, because authorization is also
  > > needed to use a lock token.  So this is the server logic to apply
  > > whenever the client provides a lock token:
  > >
  > > Is this the same authorization context that took out the lock?
  > >   Yes {
  > >    Allow the operation normally, provided the operation is
  > >    allowed, and provided the lock token is correct and all
  > >    required lock tokens are provided, etc.
  > >   } No {
  > >    Is this an UNLOCK operation, with an authorization that
  > >    includes permission to delete others' locks?
  > >    Yes {
  > >       perform UNLOCK
  > >    } No {
  > >       Fail request
  > >    }
  > >   }
  > >
  > > Lisa
  > >
  > > > -----Original Message-----
  > > > From: w3c-dist-auth-request@w3.org
  > > > [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
  > > > Sent: Wednesday, September 17, 2003 11:17 AM
  > > > To: 'Horst Liermann'; w3c-dist-auth@w3.org
  > > > Subject: RE: ACL and lockdiscovery
  > > >
  > > >
  > > >
  > > > The ACL spec hasn't defined a privilege specifically to
  > > > control read access to the lockdiscovery property, or even a
  > > > privilege to control access to all the privileges in total.
  > > > An individual server implementation could provide such a
  > > > privilege and aggregate it under <dav:read>, but this isn't
required.
  > > >
  > > > --Eric
  > > >
  > > > > -----Original Message-----
  > > > > From: w3c-dist-auth-request@w3.org
  > > > > [mailto:w3c-dist-auth-request@w3.org]
  > > > > On Behalf Of Horst Liermann
  > > > > Sent: Wednesday, September 17, 2003 10:08 AM
  > > > > To: 'w3c-dist-auth@w3.org'
  > > > >
  > > > >
  > > > > Hi all,
  > > > >
  > > > > some questions about lockdiscovery and ACL's
  > > > >
  > > > > Suppose, you have a server with WebDAV ( including lock) and it
  > > > > support's ACL. What is the behavior for lockdiscovery, can
  > > > I see all
  > > > > lock token or am I only allowed to see the tokens where I
  > > > am the owner
  > > > > of the lock ? As far as I understand, lockdiscovery reports
  > > > all locks.
  > > > > Is this a security leak ?
  > > > >
  > > > > Best Regards
  > > > >    Horst
  > > >
  > > >
  > > >
  > >
  > >

------=_NextPart_000_00EE_01C37EC2.72B95690
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1226" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D319152513-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>I basically agree with Geoff.</FONT></SPAN></DIV>
<DIV><SPAN class=3D319152513-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D319152513-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>However there's the legitamite use case that a UI needs to get =
the active=20
locks just in order to be able to display whether a resource is locked =
or not.=20
So maybe we should think of a way that handles this case, without having =
to=20
reveal "too much".</FONT></SPAN></DIV>
<DIV><FONT face=3D"Courier New" color=3D#0000ff =
size=3D2></FONT>&nbsp;</DIV>
<DIV><SPAN class=3D319152513-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>Julian</FONT></SPAN></DIV>
<P><FONT size=3D2>--<BR>&lt;green/&gt;bytes GmbH -- <A=20
href=3D"http://www.greenbytes.de/" =
target=3D_blank>http://www.greenbytes.de</A> --=20
tel:+492512807760 </FONT></P>
<BLOCKQUOTE=20
style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px =
solid">
  <DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
  size=3D2>-----Original Message-----<BR><B>From:</B> =
w3c-dist-auth-request@w3.org=20
  [mailto:w3c-dist-auth-request@w3.org]<B>On Behalf Of </B>Geoffrey M=20
  Clemm<BR><B>Sent:</B> Friday, September 19, 2003 3:19 PM<BR><B>To:</B> =

  w3c-dist-auth@w3.org<BR><B>Subject:</B> RE: ACL and=20
  lockdiscovery<BR><BR></FONT></DIV><BR><FONT size=3D2><TT>If the client =
doesn't=20
  have permission to do an UNLOCK,</TT></FONT> <BR><FONT size=3D2><TT>or =
if the=20
  lock automatically times out</TT></FONT> <BR><FONT size=3D2><TT>(the =
two use=20
  cases identified where the server is likely to withhold</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>the lock token), the client either cannot do an UNLOCK, =
or does not=20
  </TT></FONT><BR><FONT size=3D2><TT>need to do an UNLOCK.</TT></FONT>=20
  <BR><BR><FONT size=3D2><TT>WRT clients that do not store the lock =
tokens, but=20
  rather try to steal</TT></FONT> <BR><FONT size=3D2><TT>any lock token =
that is=20
  allowed by access control, this violates the whole</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>point of having lock tokens instead of just a server-side =
lock=20
  (i.e. preventing</TT></FONT> <BR><FONT size=3D2><TT>two clients =
working on=20
  behalf of the same user from stomping on each other),</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>and such a client should be fixed, not catered to by=20
  servers.</TT></FONT> <BR><BR><FONT size=3D2><TT>Cheers,</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>Geoff</TT></FONT> <BR><BR><FONT size=3D2><TT>"Lisa =
Dusseault"=20
  &lt;lisa@xythos.com&gt; wrote on 09/18/2003 12:32:20 PM:<BR><BR>&gt;=20
  Unfortunately, withholding the locktoken from the client that <BR>&gt; =

  requested that lock</TT></FONT> <BR><FONT size=3D2><TT>&gt; would =
break UNLOCK=20
  for some clients that don't store their own lock tokens.</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>&gt; Those clients might show error messages &amp; cause =
support=20
  calls.</TT></FONT> <BR><FONT size=3D2><TT>&gt; Thus, as a matter of=20
  interoperability, a server would at least have to =
</TT></FONT><BR><FONT=20
  size=3D2><TT>&gt; be careful in providing incomplete information in=20
  lockdiscovery.</TT></FONT> <BR><FONT size=3D2><TT>&gt; =
&nbsp;</TT></FONT>=20
  <BR><FONT size=3D2><TT>&gt; This area is murkier than I had thought.=20
  &nbsp;Should there be a clarification in</TT></FONT> <BR><FONT =
size=3D2><TT>&gt;=20
  RFC2518bis? It would obviously be easier to write interoperable =
clients=20
  </TT></FONT><BR><FONT size=3D2><TT>&gt; if all servers had to behave =
the same in=20
  this area. &nbsp;Is there a de facto </TT></FONT><BR><FONT =
size=3D2><TT>&gt;=20
  minimum standard here that we can clarify in the next rev?</TT></FONT> =

  <BR><FONT size=3D2><TT>&gt; &nbsp;</TT></FONT> <BR><FONT =
size=3D2><TT>&gt;=20
  lisa</TT></FONT> <BR><FONT size=3D2><TT>&gt; -----Original =
Message-----<BR>&gt;=20
  From: w3c-dist-auth-request@w3.org =
[mailto:w3c-dist-auth-request@w3.org]=20
  <BR>&gt; On Behalf Of Geoffrey M Clemm<BR>&gt; Sent: Thursday, =
September 18,=20
  2003 5:17 AM<BR>&gt; To: w3c-dist-auth@w3.org<BR>&gt; Subject: RE: ACL =
and=20
  lockdiscovery<BR></TT></FONT><BR><FONT size=3D2><TT>&gt; <BR>&gt; That =
is not=20
  correct. &nbsp;RFC-2518 explicitly states in <BR>&gt; section 13.8 =
(where the=20
  DAV:lockdiscovery property is defined): <BR>&gt; <BR>&gt; "The server =
is free=20
  to withhold any or all of this information <BR>&gt; if the requesting=20
  principal does not have sufficient access rights <BR>&gt; to see the =
requested=20
  data." <BR>&gt; <BR>&gt; In particular, if the client does not have =
sufficient=20
  access <BR>&gt; rights to UNLOCK the resource, a server could very =
reasonably=20
  <BR>&gt; choose to hide the lock-token information. <BR>&gt; <BR>&gt; =
In=20
  addition, a server for which locks have a reasonably <BR>&gt; short =
maximum=20
  expiration may chose to never expose the lock tokens <BR>&gt; (i.e. =
nobody has=20
  sufficient access rights to see the lock tokens). <BR>&gt; <BR>&gt; =
Cheers,=20
  <BR>&gt; Geoff <BR>&gt; <BR>&gt; w3c-dist-auth-request@w3.org wrote on =

  09/17/2003 07:49:20 PM:<BR>&gt; <BR>&gt; &gt; <BR>&gt; &gt; I'd also =
point out=20
  that the lockdiscovery property MUST contain<BR>&gt; &gt; all the lock =
tokens,=20
  regardless of access control settings. &nbsp;This<BR>&gt; &gt; is not=20
  considered a security leak, because authorization is also<BR>&gt; &gt; =
needed=20
  to use a lock token. &nbsp;So this is the server logic to =
apply<BR>&gt; &gt;=20
  whenever the client provides a lock token: <BR>&gt; &gt; <BR>&gt; &gt; =
Is this=20
  the same authorization context that took out the lock? <BR>&gt; &gt; =
&nbsp;=20
  Yes {<BR>&gt; &gt; &nbsp; &nbsp;Allow the operation normally, provided =
the=20
  operation is <BR>&gt; &gt; &nbsp; &nbsp;allowed, and provided the lock =
token=20
  is correct and all<BR>&gt; &gt; &nbsp; &nbsp;required lock tokens are=20
  provided, etc.<BR>&gt; &gt; &nbsp; } No {<BR>&gt; &gt; &nbsp; &nbsp;Is =
this an=20
  UNLOCK operation, with an authorization that<BR>&gt; &gt; &nbsp;=20
  &nbsp;includes permission to delete others' locks?<BR>&gt; &gt; &nbsp; =

  &nbsp;Yes {<BR>&gt; &gt; &nbsp; &nbsp; &nbsp; perform UNLOCK<BR>&gt; =
&gt;=20
  &nbsp; &nbsp;} No {<BR>&gt; &gt; &nbsp; &nbsp; &nbsp; Fail =
request<BR>&gt;=20
  &gt; &nbsp; &nbsp;}<BR>&gt; &gt; &nbsp; }<BR>&gt; &gt; <BR>&gt; &gt;=20
  Lisa<BR>&gt; &gt; <BR>&gt; &gt; &gt; -----Original =
Message-----<BR>&gt; &gt;=20
  &gt; From: w3c-dist-auth-request@w3.org <BR>&gt; &gt; &gt;=20
  [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar<BR>&gt; =
&gt;=20
  &gt; Sent: Wednesday, September 17, 2003 11:17 AM<BR>&gt; &gt; &gt; =
To: 'Horst=20
  Liermann'; w3c-dist-auth@w3.org<BR>&gt; &gt; &gt; Subject: RE: ACL and =

  lockdiscovery<BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; =
<BR>&gt;=20
  &gt; &gt; The ACL spec hasn't defined a privilege specifically to =
<BR>&gt;=20
  &gt; &gt; control read access to the lockdiscovery property, or even a =

  <BR>&gt; &gt; &gt; privilege to control access to all the privileges =
in total.=20
  &nbsp;<BR>&gt; &gt; &gt; An individual server implementation could =
provide=20
  such a <BR>&gt; &gt; &gt; privilege and aggregate it under =
&lt;dav:read&gt;,=20
  but this isn't required.<BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; =
--Eric<BR>&gt;=20
  &gt; &gt; <BR>&gt; &gt; &gt; &gt; -----Original Message-----<BR>&gt; =
&gt; &gt;=20
  &gt; From: w3c-dist-auth-request@w3.org <BR>&gt; &gt; &gt; &gt;=20
  [mailto:w3c-dist-auth-request@w3.org]<BR>&gt; &gt; &gt; &gt; On Behalf =
Of=20
  Horst Liermann<BR>&gt; &gt; &gt; &gt; Sent: Wednesday, September 17, =
2003=20
  10:08 AM<BR>&gt; &gt; &gt; &gt; To: 'w3c-dist-auth@w3.org'<BR>&gt; =
&gt; &gt;=20
  &gt; <BR>&gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; Hi all,<BR>&gt; =
&gt; &gt;=20
  &gt; <BR>&gt; &gt; &gt; &gt; some questions about lockdiscovery and=20
  ACL's<BR>&gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; Suppose, you have =
a=20
  server with WebDAV ( including lock) and it <BR>&gt; &gt; &gt; &gt; =
support's=20
  ACL. What is the behavior for lockdiscovery, can <BR>&gt; &gt; &gt; I =
see all=20
  <BR>&gt; &gt; &gt; &gt; lock token or am I only allowed to see the =
tokens=20
  where I <BR>&gt; &gt; &gt; am the owner <BR>&gt; &gt; &gt; &gt; of the =
lock ?=20
  As far as I understand, lockdiscovery reports <BR>&gt; &gt; &gt; all =
locks.=20
  <BR>&gt; &gt; &gt; &gt; Is this a security leak ?<BR>&gt; &gt; &gt; =
&gt;=20
  <BR>&gt; &gt; &gt; &gt; Best Regards<BR>&gt; &gt; &gt; &gt; &nbsp;=20
  &nbsp;Horst<BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; =
<BR>&gt;=20
  &gt; <BR>&gt; &gt; </TT></FONT></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_00EE_01C37EC2.72B95690--



From w3c-dist-auth-request@w3.org  Fri Sep 19 12:39:22 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12756
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 12:39:21 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 16C82A0584; Thu, 18 Sep 2003 19:19:49 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 33261A0584
	for <w3c-dist-auth@frink.w3.org>; Thu, 18 Sep 2003 19:19:46 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id BCC6D13618; Thu, 18 Sep 2003 19:19:45 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from terror.vuw.ac.nz (etna.vuw.ac.nz [130.195.86.25])
	by dr-nick.w3.org (Postfix) with ESMTP id BAA0E13602
	for <w3c-dist-auth@w3.org>; Thu, 18 Sep 2003 19:19:44 -0400 (EDT)
Received: from [130.195.85.188] (HELO coso.staff.vuw.ac.nz)
  by terror.vuw.ac.nz (CommuniGate Pro SMTP 3.5.9)
  with ESMTP id 186133 for w3c-dist-auth@w3.org; Fri, 19 Sep 2003 11:23:56 +1200
X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
Content-Class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Fri, 19 Sep 2003 11:19:43 +1200
Message-ID: <5744FAECB4B8864F83CB05F2E1D16EEB154B9A@coso.staff.vuw.ac.nz>
Thread-Topic: multiple "source" properties documents
Thread-Index: AcN+O1dCfKEL5cOcTpGr/0cUu1V51Q==
From: "Conal Tuohy" <Conal.Tuohy@vuw.ac.nz>
To: "WebDAV List (E-mail)" <w3c-dist-auth@w3.org>
Subject: multiple "source" properties documents
X-Archived-At: http://www.w3.org/mid/5744FAECB4B8864F83CB05F2E1D16EEB154B9A@coso.staff.vuw.ac.nz
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7884
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030918231949.16C82A0584@frink.w3.org>
Resent-Date: Thu, 18 Sep 2003 19:19:49 -0400 (EDT)
Content-Transfer-Encoding: quoted-printable


I'm writing to ask about the "source" property which supposedly can be =
used to identify the URIs of multiple source documents. I've read a lot =
of the discussion in the list archive but I was still left slightly =
confused as to the status of this property. I'm sorry if I appear to be =
bringing up an old controversy and rehashing it ... I've only recently =
joined the list so I can find out about it.

From what I read, the "source" property was a great idea but no-one ever =
implemented it, supposedly because it was too complicated and/or there =
was no perceived need. Eventually it was formally deprecated. Is this =
correct? I've also read of the "translate" header, which I gather is a =
Microsoft-specific extension? I also gather that this only supports a =
one-to-one mapping between a document and its source, i.e. a document =
has one and only one source?

My case is that I have a server which generates pages from multiple =
sources and keeps track of those sources in such a way that it could =
fairly easily support dav:source. I'd like editors to be able to edit =
the page and select which of the source documents to edit. But are there =
existing clients that will actually do that? Or are there other web-dav =
mechanisms that might support my use-case?

Currently I'm working on a system where, by adding a parameter to the =
URI of a page, the editor can access a page containing links to the =
source documents. Then they can select the source that interests them. =
I've also considered implementing this feature as an Annotea service, =
but I'd prefer to use just webdav if I thought there'd be client-side =
implementations that would use it.

Cheers

Con

--
Conal Tuohy
Senior Programmer
(04)463-6844
(021)237-2498
conal@nzetc.org
New Zealand Electronic Text Centre
www.nzetc.org



From w3c-dist-auth-request@w3.org  Fri Sep 19 12:40:17 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA12872
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 12:40:17 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 540B9A0C21; Fri, 19 Sep 2003 09:18:46 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 5D8E7A0D65
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 09:18:40 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id E78C2134BC; Fri, 19 Sep 2003 09:18:39 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 5F2AA13788
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:18:38 -0400 (EDT)
Received: (qmail 17843 invoked by uid 65534); 19 Sep 2003 13:18:32 -0000
Received: from unknown (HELO lisa) (217.5.201.10)
  by mail.gmx.net (mp003) with SMTP; 19 Sep 2003 15:18:32 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Geoffrey M Clemm" <geoffrey.clemm@us.ibm.com>,
        "'WebDAV List (E-mail)'" <w3c-dist-auth@w3.org>
Date: Fri, 19 Sep 2003 15:18:29 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCIEGDIIAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_00DE_01C37EC1.47FA9BE0"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
In-reply-to: <OFFEB7615F.0603B9BD-ON85256DA6.0040F990-85256DA6.0047F1F3@us.ibm.com>
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
Subject: RE: multiple "source" properties documents
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCIEGDIIAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7887
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919131846.540B9A0C21@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 09:18:46 -0400 (EDT)


This is a multi-part message in MIME format.

------=_NextPart_000_00DE_01C37EC1.47FA9BE0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Geoff,

please re-read the old discussion on the mailing list. RFC2518 specifies a
format that indeed doesn't make any sense (can you explain what the DAV:src
sub-element is for?).

So *if* this feature is to remain in RFC2518, at least the format needs to
be fixed (possibly in a way backwards compatible to RFC2518).

Julian
--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

  -----Original Message-----
  From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]On
Behalf Of Geoffrey M Clemm
  Sent: Friday, September 19, 2003 3:06 PM
  To: 'WebDAV List (E-mail)'
  Subject: RE: multiple "source" properties documents



  My perspective is a bit different.  The DAV:source property
  was designed for exactly the situation that Conal describes.
  He'd like a generic application to pop up the list of URL's
  and say "these are the sources".  There are no significant
  testing issues ... the format of the DAV:source property is
  well defined, and all a client is expected to do is to expose
  the specified list of URL's.

  So in Conal's case, I'd just expose this feature using the
  DAV:source property, and you are no worse off that if you
  just defined your own custom property, and that if enough
  folks do so, the property will become "undeprecated".

  Note: I am not arguing against deprecating the DAV:source
  feature ... I don't think the topic is significant enough
  to merit being re-opened ... I'm just saying that if you are
  an implementor and encounter a valid use for the DAV:source
  property, you should go ahead and use it instead of inventing
  your own custom property, even if it is deprecated in 2518bis.

  Cheers,
  Geoff


  Lisa wrote on 09/18/2003 07:41:56 PM:

  >
  >
  > > From what I read, the "source" property was a great idea but
  > > no-one ever implemented it, supposedly because it was too
  > > complicated and/or there was no perceived need.
  >
  > I'd characterize the reasons a little differently:
  >  1) The feature was underspecified, there was never enough
  >    information in the spec to be able to fully implement
  >    or interoperate
  >  2) Implementation interest was low -- we asked around to see
  >    who had implemented this feature and got no positive
  >    responses at all.
  >
  > > Eventually it
  > > was formally deprecated. Is this correct?
  >
  > The deprecation isn't final yet, but we are proposing to
  > deprecate it.
  >
  > > I've also read of
  > > the "translate" header, which I gather is a
  > > Microsoft-specific extension? I also gather that this only
  > > supports a one-to-one mapping between a document and its
  > > source, i.e. a document has one and only one source?
  >
  > Yes
  >
  > > My case is that I have a server which generates pages from
  > > multiple sources and keeps track of those sources in such a
  > > way that it could fairly easily support dav:source. I'd like
  > > editors to be able to edit the page and select which of the
  > > source documents to edit. But are there existing clients that
  > > will actually do that? Or are there other web-dav mechanisms
  > > that might support my use-case?
  >
  > Not that I know of.  You'd be the first to implement a
  > protocol feature to expose multiple mappings so nobody
  > to interoperate with and no tools to support your feature.
  >
  > If there is sufficient interest from implementors to make
  > forward progress on this, I'd recommend a separate draft rather
  > than resurrect the unimplemented, underspecified, and untested
  > feature in RFC2518.
  >
  > Lisa
  >
  >

------=_NextPart_000_00DE_01C37EC1.47FA9BE0
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1226" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D448131613-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>Geoff,</FONT></SPAN></DIV>
<DIV><SPAN class=3D448131613-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D448131613-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>please re-read the old discussion on the mailing list. RFC2518 =
specifies=20
a format that indeed doesn't make any sense (can you explain what the =
DAV:src=20
sub-element is for?).</FONT></SPAN></DIV>
<DIV><SPAN class=3D448131613-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D448131613-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>So *if* this feature is to remain in RFC2518, at least the =
format needs=20
to be fixed (possibly in a way backwards compatible to=20
RFC2518).</FONT></SPAN></DIV>
<DIV><SPAN class=3D448131613-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D448131613-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>Julian</FONT></SPAN></DIV>
<P><FONT size=3D2>--<BR>&lt;green/&gt;bytes GmbH -- <A=20
href=3D"http://www.greenbytes.de/" =
target=3D_blank>http://www.greenbytes.de</A> --=20
tel:+492512807760 </FONT></P>
<BLOCKQUOTE=20
style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px =
solid">
  <DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
  size=3D2>-----Original Message-----<BR><B>From:</B> =
w3c-dist-auth-request@w3.org=20
  [mailto:w3c-dist-auth-request@w3.org]<B>On Behalf Of </B>Geoffrey M=20
  Clemm<BR><B>Sent:</B> Friday, September 19, 2003 3:06 PM<BR><B>To:</B> =
'WebDAV=20
  List (E-mail)'<BR><B>Subject:</B> RE: multiple "source" properties=20
  documents<BR><BR></FONT></DIV><BR><FONT size=3D2><TT>My perspective is =
a bit=20
  different. &nbsp;The DAV:source property</TT></FONT> <BR><FONT =
size=3D2><TT>was=20
  designed for exactly the situation that Conal describes.</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>He'd like a generic application to pop up the list of=20
  URL's</TT></FONT> <BR><FONT size=3D2><TT>and say "these are the =
sources".=20
  &nbsp;There are no significant</TT></FONT> <BR><FONT =
size=3D2><TT>testing issues=20
  ... the format of the DAV:source property is</TT></FONT> <BR><FONT=20
  size=3D2><TT>well defined, and all a client is expected to do is to=20
  expose</TT></FONT> <BR><FONT size=3D2><TT>the specified list of=20
  URL's.</TT></FONT> <BR><BR><FONT size=3D2><TT>So in Conal's case, I'd =
just=20
  expose this feature using the</TT></FONT> <BR><FONT =
size=3D2><TT>DAV:source=20
  property, and you are no worse off that if you</TT></FONT> <BR><FONT=20
  size=3D2><TT>just defined your own custom property, and that if=20
  enough</TT></FONT> <BR><FONT size=3D2><TT>folks do so, the property =
will become=20
  "undeprecated".</TT></FONT> <BR><BR><FONT size=3D2><TT>Note: I am not =
arguing=20
  against deprecating the DAV:source</TT></FONT> <BR><FONT =
size=3D2><TT>feature=20
  ... I don't think the topic is significant enough</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>to merit being re-opened ... I'm just saying that if you=20
  are</TT></FONT> <BR><FONT size=3D2><TT>an implementor and encounter a =
valid use=20
  for the DAV:source</TT></FONT> <BR><FONT size=3D2><TT>property, you =
should go=20
  ahead and use it instead of inventing</TT></FONT> <BR><FONT =
size=3D2><TT>your=20
  own custom property, even if it is deprecated in 2518bis.</TT></FONT>=20
  <BR><BR><FONT size=3D2><TT>Cheers,</TT></FONT> <BR><FONT=20
  size=3D2><TT>Geoff</TT></FONT> <BR><BR><BR><FONT size=3D2><TT>Lisa =
wrote on=20
  09/18/2003 07:41:56 PM:<BR><BR>&gt; <BR>&gt; <BR>&gt; &gt; From what I =
read,=20
  the "source" property was a great idea but <BR>&gt; &gt; no-one ever=20
  implemented it, supposedly because it was too <BR>&gt; &gt; =
complicated and/or=20
  there was no perceived need. <BR>&gt; <BR>&gt; I'd characterize the =
reasons a=20
  little differently: <BR>&gt; &nbsp;1) The feature was underspecified, =
there=20
  was never enough <BR>&gt; &nbsp; &nbsp;information in the spec to be =
able to=20
  fully implement<BR>&gt; &nbsp; &nbsp;or interoperate<BR>&gt; &nbsp;2)=20
  Implementation interest was low -- we asked around to see<BR>&gt; =
&nbsp;=20
  &nbsp;who had implemented this feature and got no positive<BR>&gt; =
&nbsp;=20
  &nbsp;responses at all.<BR>&gt; <BR>&gt; &gt; Eventually it <BR>&gt; =
&gt; was=20
  formally deprecated. Is this correct? <BR>&gt; <BR>&gt; The =
deprecation isn't=20
  final yet, but we are proposing to <BR>&gt; deprecate it.<BR>&gt; =
<BR>&gt;=20
  &gt; I've also read of <BR>&gt; &gt; the "translate" header, which I =
gather is=20
  a <BR>&gt; &gt; Microsoft-specific extension? I also gather that this =
only=20
  <BR>&gt; &gt; supports a one-to-one mapping between a document and its =

  <BR>&gt; &gt; source, i.e. a document has one and only one =
source?<BR>&gt;=20
  <BR>&gt; Yes<BR>&gt; <BR>&gt; &gt; My case is that I have a server =
which=20
  generates pages from <BR>&gt; &gt; multiple sources and keeps track of =
those=20
  sources in such a <BR>&gt; &gt; way that it could fairly easily =
support=20
  dav:source. I'd like <BR>&gt; &gt; editors to be able to edit the page =
and=20
  select which of the <BR>&gt; &gt; source documents to edit. But are =
there=20
  existing clients that <BR>&gt; &gt; will actually do that? Or are =
there other=20
  web-dav mechanisms <BR>&gt; &gt; that might support my =
use-case?<BR>&gt;=20
  <BR>&gt; Not that I know of. &nbsp;You'd be the first to implement a =
<BR>&gt;=20
  protocol feature to expose multiple mappings so nobody<BR>&gt; to =
interoperate=20
  with and no tools to support your feature.<BR>&gt; <BR>&gt; If there =
is=20
  sufficient interest from implementors to make<BR>&gt; forward progress =
on=20
  this, I'd recommend a separate draft rather<BR>&gt; than resurrect the =

  unimplemented, underspecified, and untested<BR>&gt; feature in=20
  RFC2518.<BR>&gt; <BR>&gt; Lisa<BR>&gt; <BR>&gt;=20
<BR></BLOCKQUOTE></TT></FONT></BODY></HTML>

------=_NextPart_000_00DE_01C37EC1.47FA9BE0--



From w3c-dist-auth-request@w3.org  Fri Sep 19 12:41:15 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA13011
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 12:41:15 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 6EC2AA0531; Fri, 19 Sep 2003 09:06:03 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id BB9F9A0651
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 09:06:00 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 665791372A; Fri, 19 Sep 2003 09:06:00 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from e5.ny.us.ibm.com (e5.ny.us.ibm.com [32.97.182.105])
	by dr-nick.w3.org (Postfix) with ESMTP id 42A821361E
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:06:00 -0400 (EDT)
Received: from northrelay02.pok.ibm.com (northrelay02.pok.ibm.com [9.56.224.150])
	by e5.ny.us.ibm.com (8.12.10/8.12.2) with ESMTP id h8JD5xEd693562
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:05:59 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay02.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h8JD5uT0209116
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:05:59 -0400
In-Reply-To: <017c01c37e3e$760cac40$f8cb90c6@lisalap>
To: "'WebDAV List (E-mail)'" <w3c-dist-auth@w3.org>
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Message-ID: <OFFEB7615F.0603B9BD-ON85256DA6.0040F990-85256DA6.0047F1F3@us.ibm.com>
Date: Fri, 19 Sep 2003 09:05:49 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/19/2003 09:05:58,
	Serialize complete at 09/19/2003 09:05:58
Content-Type: multipart/alternative; boundary="=_alternative 004556C585256DA6_="
Subject: RE: multiple "source" properties documents
X-Archived-At: http://www.w3.org/mid/OFFEB7615F.0603B9BD-ON85256DA6.0040F990-85256DA6.0047F1F3@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7886
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919130603.6EC2AA0531@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 09:06:03 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 004556C585256DA6_=
Content-Type: text/plain; charset="US-ASCII"

My perspective is a bit different.  The DAV:source property
was designed for exactly the situation that Conal describes.
He'd like a generic application to pop up the list of URL's
and say "these are the sources".  There are no significant
testing issues ... the format of the DAV:source property is
well defined, and all a client is expected to do is to expose
the specified list of URL's.

So in Conal's case, I'd just expose this feature using the
DAV:source property, and you are no worse off that if you
just defined your own custom property, and that if enough
folks do so, the property will become "undeprecated".

Note: I am not arguing against deprecating the DAV:source
feature ... I don't think the topic is significant enough
to merit being re-opened ... I'm just saying that if you are
an implementor and encounter a valid use for the DAV:source
property, you should go ahead and use it instead of inventing
your own custom property, even if it is deprecated in 2518bis.

Cheers,
Geoff


Lisa wrote on 09/18/2003 07:41:56 PM:

> 
> 
> > From what I read, the "source" property was a great idea but 
> > no-one ever implemented it, supposedly because it was too 
> > complicated and/or there was no perceived need. 
> 
> I'd characterize the reasons a little differently: 
>  1) The feature was underspecified, there was never enough 
>    information in the spec to be able to fully implement
>    or interoperate
>  2) Implementation interest was low -- we asked around to see
>    who had implemented this feature and got no positive
>    responses at all.
> 
> > Eventually it 
> > was formally deprecated. Is this correct? 
> 
> The deprecation isn't final yet, but we are proposing to 
> deprecate it.
> 
> > I've also read of 
> > the "translate" header, which I gather is a 
> > Microsoft-specific extension? I also gather that this only 
> > supports a one-to-one mapping between a document and its 
> > source, i.e. a document has one and only one source?
> 
> Yes
> 
> > My case is that I have a server which generates pages from 
> > multiple sources and keeps track of those sources in such a 
> > way that it could fairly easily support dav:source. I'd like 
> > editors to be able to edit the page and select which of the 
> > source documents to edit. But are there existing clients that 
> > will actually do that? Or are there other web-dav mechanisms 
> > that might support my use-case?
> 
> Not that I know of.  You'd be the first to implement a 
> protocol feature to expose multiple mappings so nobody
> to interoperate with and no tools to support your feature.
> 
> If there is sufficient interest from implementors to make
> forward progress on this, I'd recommend a separate draft rather
> than resurrect the unimplemented, underspecified, and untested
> feature in RFC2518.
> 
> Lisa
> 
> 

--=_alternative 004556C585256DA6_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2><tt>My perspective is a bit different. &nbsp;The DAV:source
property</tt></font>
<br><font size=2><tt>was designed for exactly the situation that Conal
describes.</tt></font>
<br><font size=2><tt>He'd like a generic application to pop up the list
of URL's</tt></font>
<br><font size=2><tt>and say &quot;these are the sources&quot;. &nbsp;There
are no significant</tt></font>
<br><font size=2><tt>testing issues ... the format of the DAV:source property
is</tt></font>
<br><font size=2><tt>well defined, and all a client is expected to do is
to expose</tt></font>
<br><font size=2><tt>the specified list of URL's.</tt></font>
<br>
<br><font size=2><tt>So in Conal's case, I'd just expose this feature using
the</tt></font>
<br><font size=2><tt>DAV:source property, and you are no worse off that
if you</tt></font>
<br><font size=2><tt>just defined your own custom property, and that if
enough</tt></font>
<br><font size=2><tt>folks do so, the property will become &quot;undeprecated&quot;.</tt></font>
<br>
<br><font size=2><tt>Note: I am not arguing against deprecating the DAV:source</tt></font>
<br><font size=2><tt>feature ... I don't think the topic is significant
enough</tt></font>
<br><font size=2><tt>to merit being re-opened ... I'm just saying that
if you are</tt></font>
<br><font size=2><tt>an implementor and encounter a valid use for the DAV:source</tt></font>
<br><font size=2><tt>property, you should go ahead and use it instead of
inventing</tt></font>
<br><font size=2><tt>your own custom property, even if it is deprecated
in 2518bis.</tt></font>
<br>
<br><font size=2><tt>Cheers,</tt></font>
<br><font size=2><tt>Geoff</tt></font>
<br>
<br>
<br><font size=2><tt>Lisa wrote on 09/18/2003 07:41:56 PM:<br>
<br>
&gt; <br>
&gt; <br>
&gt; &gt; From what I read, the &quot;source&quot; property was a great
idea but <br>
&gt; &gt; no-one ever implemented it, supposedly because it was too <br>
&gt; &gt; complicated and/or there was no perceived need. <br>
&gt; <br>
&gt; I'd characterize the reasons a little differently: <br>
&gt; &nbsp;1) The feature was underspecified, there was never enough <br>
&gt; &nbsp; &nbsp;information in the spec to be able to fully implement<br>
&gt; &nbsp; &nbsp;or interoperate<br>
&gt; &nbsp;2) Implementation interest was low -- we asked around to see<br>
&gt; &nbsp; &nbsp;who had implemented this feature and got no positive<br>
&gt; &nbsp; &nbsp;responses at all.<br>
&gt; <br>
&gt; &gt; Eventually it <br>
&gt; &gt; was formally deprecated. Is this correct? <br>
&gt; <br>
&gt; The deprecation isn't final yet, but we are proposing to <br>
&gt; deprecate it.<br>
&gt; <br>
&gt; &gt; I've also read of <br>
&gt; &gt; the &quot;translate&quot; header, which I gather is a <br>
&gt; &gt; Microsoft-specific extension? I also gather that this only <br>
&gt; &gt; supports a one-to-one mapping between a document and its <br>
&gt; &gt; source, i.e. a document has one and only one source?<br>
&gt; <br>
&gt; Yes<br>
&gt; <br>
&gt; &gt; My case is that I have a server which generates pages from <br>
&gt; &gt; multiple sources and keeps track of those sources in such a <br>
&gt; &gt; way that it could fairly easily support dav:source. I'd like
<br>
&gt; &gt; editors to be able to edit the page and select which of the <br>
&gt; &gt; source documents to edit. But are there existing clients that
<br>
&gt; &gt; will actually do that? Or are there other web-dav mechanisms
<br>
&gt; &gt; that might support my use-case?<br>
&gt; <br>
&gt; Not that I know of. &nbsp;You'd be the first to implement a <br>
&gt; protocol feature to expose multiple mappings so nobody<br>
&gt; to interoperate with and no tools to support your feature.<br>
&gt; <br>
&gt; If there is sufficient interest from implementors to make<br>
&gt; forward progress on this, I'd recommend a separate draft rather<br>
&gt; than resurrect the unimplemented, underspecified, and untested<br>
&gt; feature in RFC2518.<br>
&gt; <br>
&gt; Lisa<br>
&gt; <br>
&gt; <br>
</tt></font>
--=_alternative 004556C585256DA6_=--



From w3c-dist-auth-request@w3.org  Fri Sep 19 12:41:30 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA13056
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 12:41:30 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id ADA78A0651; Fri, 19 Sep 2003 09:18:53 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 46857A0651
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 09:18:52 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id CDC77137A6; Fri, 19 Sep 2003 09:18:51 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from e6.ny.us.ibm.com (e6.ny.us.ibm.com [32.97.182.106])
	by dr-nick.w3.org (Postfix) with ESMTP id 9F52D134BC
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:18:51 -0400 (EDT)
Received: from northrelay02.pok.ibm.com (northrelay02.pok.ibm.com [9.56.224.150])
	by e6.ny.us.ibm.com (8.12.10/8.12.2) with ESMTP id h8JDIpIq738946
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:18:51 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay02.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h8JDIoSu217798
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 09:18:50 -0400
In-Reply-To: <010501c37e02$6e8bb5b0$f8cb90c6@lisalap>
To: w3c-dist-auth@w3.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
Message-ID: <OFC555C2D1.B14F1A5E-ON85256DA6.00481CCF-85256DA6.00491E8B@us.ibm.com>
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Date: Fri, 19 Sep 2003 09:18:39 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/19/2003 09:18:50,
	Serialize complete at 09/19/2003 09:18:50
Content-Type: multipart/alternative; boundary="=_alternative 00491E8785256DA6_="
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/OFC555C2D1.B14F1A5E-ON85256DA6.00481CCF-85256DA6.00491E8B@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7888
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919131853.ADA78A0651@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 09:18:53 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 00491E8785256DA6_=
Content-Type: text/plain; charset="US-ASCII"

If the client doesn't have permission to do an UNLOCK,
or if the lock automatically times out
(the two use cases identified where the server is likely to withhold
the lock token), the client either cannot do an UNLOCK, or does not 
need to do an UNLOCK.

WRT clients that do not store the lock tokens, but rather try to steal
any lock token that is allowed by access control, this violates the whole
point of having lock tokens instead of just a server-side lock (i.e. 
preventing
two clients working on behalf of the same user from stomping on each 
other),
and such a client should be fixed, not catered to by servers.

Cheers,
Geoff

"Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003 12:32:20 PM:

> Unfortunately, withholding the locktoken from the client that 
> requested that lock
> would break UNLOCK for some clients that don't store their own lock 
tokens.
> Those clients might show error messages & cause support calls.
> Thus, as a matter of interoperability, a server would at least have to 
> be careful in providing incomplete information in lockdiscovery.
> 
> This area is murkier than I had thought.  Should there be a 
clarification in
> RFC2518bis? It would obviously be easier to write interoperable clients 
> if all servers had to behave the same in this area.  Is there a de facto 

> minimum standard here that we can clarify in the next rev?
> 
> lisa
> -----Original Message-----
> From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org] 

> On Behalf Of Geoffrey M Clemm
> Sent: Thursday, September 18, 2003 5:17 AM
> To: w3c-dist-auth@w3.org
> Subject: RE: ACL and lockdiscovery

> 
> That is not correct.  RFC-2518 explicitly states in 
> section 13.8 (where the DAV:lockdiscovery property is defined): 
> 
> "The server is free to withhold any or all of this information 
> if the requesting principal does not have sufficient access rights 
> to see the requested data." 
> 
> In particular, if the client does not have sufficient access 
> rights to UNLOCK the resource, a server could very reasonably 
> choose to hide the lock-token information. 
> 
> In addition, a server for which locks have a reasonably 
> short maximum expiration may chose to never expose the lock tokens 
> (i.e. nobody has sufficient access rights to see the lock tokens). 
> 
> Cheers, 
> Geoff 
> 
> w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
> 
> > 
> > I'd also point out that the lockdiscovery property MUST contain
> > all the lock tokens, regardless of access control settings.  This
> > is not considered a security leak, because authorization is also
> > needed to use a lock token.  So this is the server logic to apply
> > whenever the client provides a lock token: 
> > 
> > Is this the same authorization context that took out the lock? 
> >   Yes {
> >    Allow the operation normally, provided the operation is 
> >    allowed, and provided the lock token is correct and all
> >    required lock tokens are provided, etc.
> >   } No {
> >    Is this an UNLOCK operation, with an authorization that
> >    includes permission to delete others' locks?
> >    Yes {
> >       perform UNLOCK
> >    } No {
> >       Fail request
> >    }
> >   }
> > 
> > Lisa
> > 
> > > -----Original Message-----
> > > From: w3c-dist-auth-request@w3.org 
> > > [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> > > Sent: Wednesday, September 17, 2003 11:17 AM
> > > To: 'Horst Liermann'; w3c-dist-auth@w3.org
> > > Subject: RE: ACL and lockdiscovery
> > > 
> > > 
> > > 
> > > The ACL spec hasn't defined a privilege specifically to 
> > > control read access to the lockdiscovery property, or even a 
> > > privilege to control access to all the privileges in total. 
> > > An individual server implementation could provide such a 
> > > privilege and aggregate it under <dav:read>, but this isn't 
required.
> > > 
> > > --Eric
> > > 
> > > > -----Original Message-----
> > > > From: w3c-dist-auth-request@w3.org 
> > > > [mailto:w3c-dist-auth-request@w3.org]
> > > > On Behalf Of Horst Liermann
> > > > Sent: Wednesday, September 17, 2003 10:08 AM
> > > > To: 'w3c-dist-auth@w3.org'
> > > > 
> > > > 
> > > > Hi all,
> > > > 
> > > > some questions about lockdiscovery and ACL's
> > > > 
> > > > Suppose, you have a server with WebDAV ( including lock) and it 
> > > > support's ACL. What is the behavior for lockdiscovery, can 
> > > I see all 
> > > > lock token or am I only allowed to see the tokens where I 
> > > am the owner 
> > > > of the lock ? As far as I understand, lockdiscovery reports 
> > > all locks. 
> > > > Is this a security leak ?
> > > > 
> > > > Best Regards
> > > >    Horst
> > > 
> > > 
> > > 
> > 
> > 
--=_alternative 00491E8785256DA6_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2><tt>If the client doesn't have permission to do an UNLOCK,</tt></font>
<br><font size=2><tt>or if the lock automatically times out</tt></font>
<br><font size=2><tt>(the two use cases identified where the server is
likely to withhold</tt></font>
<br><font size=2><tt>the lock token), the client either cannot do an UNLOCK,
or does not </tt></font>
<br><font size=2><tt>need to do an UNLOCK.</tt></font>
<br>
<br><font size=2><tt>WRT clients that do not store the lock tokens, but
rather try to steal</tt></font>
<br><font size=2><tt>any lock token that is allowed by access control,
this violates the whole</tt></font>
<br><font size=2><tt>point of having lock tokens instead of just a server-side
lock (i.e. preventing</tt></font>
<br><font size=2><tt>two clients working on behalf of the same user from
stomping on each other),</tt></font>
<br><font size=2><tt>and such a client should be fixed, not catered to
by servers.</tt></font>
<br>
<br><font size=2><tt>Cheers,</tt></font>
<br><font size=2><tt>Geoff</tt></font>
<br>
<br><font size=2><tt>&quot;Lisa Dusseault&quot; &lt;lisa@xythos.com&gt;
wrote on 09/18/2003 12:32:20 PM:<br>
<br>
&gt; Unfortunately, withholding the locktoken from the client that <br>
&gt; requested that lock</tt></font>
<br><font size=2><tt>&gt; would break UNLOCK for some clients that don't
store their own lock tokens.</tt></font>
<br><font size=2><tt>&gt; Those clients might show error messages &amp;
cause support calls.</tt></font>
<br><font size=2><tt>&gt; Thus, as a matter of interoperability, a server
would at least have to </tt></font>
<br><font size=2><tt>&gt; be careful in providing incomplete information
in lockdiscovery.</tt></font>
<br><font size=2><tt>&gt; &nbsp;</tt></font>
<br><font size=2><tt>&gt; This area is murkier than I had thought. &nbsp;Should
there be a clarification in</tt></font>
<br><font size=2><tt>&gt; RFC2518bis? It would obviously be easier to write
interoperable clients </tt></font>
<br><font size=2><tt>&gt; if all servers had to behave the same in this
area. &nbsp;Is there a de facto </tt></font>
<br><font size=2><tt>&gt; minimum standard here that we can clarify in
the next rev?</tt></font>
<br><font size=2><tt>&gt; &nbsp;</tt></font>
<br><font size=2><tt>&gt; lisa</tt></font>
<br><font size=2><tt>&gt; -----Original Message-----<br>
&gt; From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]
<br>
&gt; On Behalf Of Geoffrey M Clemm<br>
&gt; Sent: Thursday, September 18, 2003 5:17 AM<br>
&gt; To: w3c-dist-auth@w3.org<br>
&gt; Subject: RE: ACL and lockdiscovery<br>
</tt></font>
<br><font size=2><tt>&gt; <br>
&gt; That is not correct. &nbsp;RFC-2518 explicitly states in <br>
&gt; section 13.8 (where the DAV:lockdiscovery property is defined): <br>
&gt; <br>
&gt; &quot;The server is free to withhold any or all of this information
<br>
&gt; if the requesting principal does not have sufficient access rights
<br>
&gt; to see the requested data.&quot; <br>
&gt; <br>
&gt; In particular, if the client does not have sufficient access <br>
&gt; rights to UNLOCK the resource, a server could very reasonably <br>
&gt; choose to hide the lock-token information. <br>
&gt; <br>
&gt; In addition, a server for which locks have a reasonably <br>
&gt; short maximum expiration may chose to never expose the lock tokens
<br>
&gt; (i.e. nobody has sufficient access rights to see the lock tokens).
<br>
&gt; <br>
&gt; Cheers, <br>
&gt; Geoff <br>
&gt; <br>
&gt; w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:<br>
&gt; <br>
&gt; &gt; <br>
&gt; &gt; I'd also point out that the lockdiscovery property MUST contain<br>
&gt; &gt; all the lock tokens, regardless of access control settings. &nbsp;This<br>
&gt; &gt; is not considered a security leak, because authorization is also<br>
&gt; &gt; needed to use a lock token. &nbsp;So this is the server logic
to apply<br>
&gt; &gt; whenever the client provides a lock token: <br>
&gt; &gt; <br>
&gt; &gt; Is this the same authorization context that took out the lock?
<br>
&gt; &gt; &nbsp; Yes {<br>
&gt; &gt; &nbsp; &nbsp;Allow the operation normally, provided the operation
is <br>
&gt; &gt; &nbsp; &nbsp;allowed, and provided the lock token is correct
and all<br>
&gt; &gt; &nbsp; &nbsp;required lock tokens are provided, etc.<br>
&gt; &gt; &nbsp; } No {<br>
&gt; &gt; &nbsp; &nbsp;Is this an UNLOCK operation, with an authorization
that<br>
&gt; &gt; &nbsp; &nbsp;includes permission to delete others' locks?<br>
&gt; &gt; &nbsp; &nbsp;Yes {<br>
&gt; &gt; &nbsp; &nbsp; &nbsp; perform UNLOCK<br>
&gt; &gt; &nbsp; &nbsp;} No {<br>
&gt; &gt; &nbsp; &nbsp; &nbsp; Fail request<br>
&gt; &gt; &nbsp; &nbsp;}<br>
&gt; &gt; &nbsp; }<br>
&gt; &gt; <br>
&gt; &gt; Lisa<br>
&gt; &gt; <br>
&gt; &gt; &gt; -----Original Message-----<br>
&gt; &gt; &gt; From: w3c-dist-auth-request@w3.org <br>
&gt; &gt; &gt; [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric
Sedlar<br>
&gt; &gt; &gt; Sent: Wednesday, September 17, 2003 11:17 AM<br>
&gt; &gt; &gt; To: 'Horst Liermann'; w3c-dist-auth@w3.org<br>
&gt; &gt; &gt; Subject: RE: ACL and lockdiscovery<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; The ACL spec hasn't defined a privilege specifically to
<br>
&gt; &gt; &gt; control read access to the lockdiscovery property, or even
a <br>
&gt; &gt; &gt; privilege to control access to all the privileges in total.
&nbsp;<br>
&gt; &gt; &gt; An individual server implementation could provide such a
<br>
&gt; &gt; &gt; privilege and aggregate it under &lt;dav:read&gt;, but this
isn't required.<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; --Eric<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; -----Original Message-----<br>
&gt; &gt; &gt; &gt; From: w3c-dist-auth-request@w3.org <br>
&gt; &gt; &gt; &gt; [mailto:w3c-dist-auth-request@w3.org]<br>
&gt; &gt; &gt; &gt; On Behalf Of Horst Liermann<br>
&gt; &gt; &gt; &gt; Sent: Wednesday, September 17, 2003 10:08 AM<br>
&gt; &gt; &gt; &gt; To: 'w3c-dist-auth@w3.org'<br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; Hi all,<br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; some questions about lockdiscovery and ACL's<br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; Suppose, you have a server with WebDAV ( including
lock) and it <br>
&gt; &gt; &gt; &gt; support's ACL. What is the behavior for lockdiscovery,
can <br>
&gt; &gt; &gt; I see all <br>
&gt; &gt; &gt; &gt; lock token or am I only allowed to see the tokens where
I <br>
&gt; &gt; &gt; am the owner <br>
&gt; &gt; &gt; &gt; of the lock ? As far as I understand, lockdiscovery
reports <br>
&gt; &gt; &gt; all locks. <br>
&gt; &gt; &gt; &gt; Is this a security leak ?<br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; Best Regards<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;Horst<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; <br>
&gt; &gt; <br>
&gt; &gt; </tt></font>
--=_alternative 00491E8785256DA6_=--



From w3c-dist-auth-request@w3.org  Fri Sep 19 12:43:27 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA13392
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 12:43:27 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 24650A0651; Fri, 19 Sep 2003 12:43:35 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 3FDF7A0700
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 12:43:33 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 110A5135BB; Fri, 19 Sep 2003 12:43:33 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from e3.ny.us.ibm.com (e3.ny.us.ibm.com [32.97.182.103])
	by dr-nick.w3.org (Postfix) with ESMTP id D24C11339C
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 12:43:32 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e3.ny.us.ibm.com (8.12.10/8.12.2) with ESMTP id h8JGhW7A416016
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 12:43:32 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h8JGhVOu217568
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 12:43:31 -0400
In-Reply-To: <JIEGINCHMLABHJBIGKBCKEHAIIAA.julian.reschke@gmx.de>
To: w3c-dist-auth@w3.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Message-ID: <OF2267EE8F.A091BDE4-ON85256DA6.005B7AE6-85256DA6.005BDA1A@us.ibm.com>
Date: Fri, 19 Sep 2003 12:43:15 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/19/2003 12:43:31,
	Serialize complete at 09/19/2003 12:43:31
Content-Type: multipart/alternative; boundary="=_alternative 005BD4FE85256DA6_="
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/OF2267EE8F.A091BDE4-ON85256DA6.005B7AE6-85256DA6.005BDA1A@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7893
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919164335.24650A0651@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 12:43:35 -0400 (EDT)


This is a multipart message in MIME format.
--=_alternative 005BD4FE85256DA6_=
Content-Type: text/plain; charset="US-ASCII"

A compliant client should be prepared for the absence of a lock token,
since the DTD for DAV:activelock explicitly marks it as being optional.

But that of course doesn't answer Julian's actual question, which is
whether existing clients are correctly implemented (:-).

Cheers,
Geoff

Julian wrote on 09/19/2003 12:10:36 PM:

> OK,
> 
> so what's the best interoperable way to hide the lock token? Simply 
> leaving out the locktoken/href element, or supplying a dummy (such 
> as "DAV:private") instead? Does any currently deployed server do this 
already?
> 
> Julian
> --
> <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760 
> -----Original Message-----
> From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]
> On Behalf Of Geoffrey M Clemm
> Sent: Friday, September 19, 2003 3:51 PM
> To: w3c-dist-auth@w3.org
> Subject: RE: ACL and lockdiscovery

> 
> Just to be clear, I was in no way advocating that the presence 
> of the lock itself should be hidden.  I was just indicating the 
> cases when the suppression of the *lock-token* field in the 
> lock-discovery data is likely to be desireable. 
> 
> Cheers, 
> Geoff 
> 
> w3c-dist-auth-request@w3.org wrote on 09/19/2003 09:26:50 AM:
> 
> > I basically agree with Geoff. 
> > 
> > However there's the legitamite use case that a UI needs to get the 
> > active locks just in order to be able to display whether a resource 
> > is locked or not. So maybe we should think of a way that handles 
> > this case, without having to reveal "too much". 
> > 
> > Julian 
> > --
> > <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760 
> > -----Original Message-----
> > From: w3c-dist-auth-request@w3.org 
[mailto:w3c-dist-auth-request@w3.org]
> > On Behalf Of Geoffrey M Clemm
> > Sent: Friday, September 19, 2003 3:19 PM
> > To: w3c-dist-auth@w3.org
> > Subject: RE: ACL and lockdiscovery
> 
> > 
> > If the client doesn't have permission to do an UNLOCK, 
> > or if the lock automatically times out 
> > (the two use cases identified where the server is likely to withhold 
> > the lock token), the client either cannot do an UNLOCK, or does not 
> > need to do an UNLOCK. 
> > 
> > WRT clients that do not store the lock tokens, but rather try to steal 

> > any lock token that is allowed by access control, this violates the 
whole 
> > point of having lock tokens instead of just a server-side lock (i.
> e.preventing
> > two clients working on behalf of the same user from stomping on 
> each other), 
> > and such a client should be fixed, not catered to by servers. 
> > 
> > Cheers, 
> > Geoff 
> > 
> > "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003 12:32:20 PM:
> > 
> > > Unfortunately, withholding the locktoken from the client that 
> > > requested that lock 
> > > would break UNLOCK for some clients that don't store their own 
> lock tokens.
> > > Those clients might show error messages & cause support calls. 
> > > Thus, as a matter of interoperability, a server would at least have 
to 
> > > be careful in providing incomplete information in lockdiscovery. 
> > > 
> > > This area is murkier than I had thought.  Should there be a 
> clarification in
> > > RFC2518bis? It would obviously be easier to write interoperable 
clients 
> > > if all servers had to behave the same in this area.  Is there a de 
facto 
> > > minimum standard here that we can clarify in the next rev? 
> > > 
> > > lisa 
> > > -----Original Message-----
> > > From: w3c-dist-auth-request@w3.org 
[mailto:w3c-dist-auth-request@w3.org] 
> > > On Behalf Of Geoffrey M Clemm
> > > Sent: Thursday, September 18, 2003 5:17 AM
> > > To: w3c-dist-auth@w3.org
> > > Subject: RE: ACL and lockdiscovery
> > 
> > > 
> > > That is not correct.  RFC-2518 explicitly states in 
> > > section 13.8 (where the DAV:lockdiscovery property is defined): 
> > > 
> > > "The server is free to withhold any or all of this information 
> > > if the requesting principal does not have sufficient access rights 
> > > to see the requested data." 
> > > 
> > > In particular, if the client does not have sufficient access 
> > > rights to UNLOCK the resource, a server could very reasonably 
> > > choose to hide the lock-token information. 
> > > 
> > > In addition, a server for which locks have a reasonably 
> > > short maximum expiration may chose to never expose the lock tokens 
> > > (i.e. nobody has sufficient access rights to see the lock tokens). 
> > > 
> > > Cheers, 
> > > Geoff 
> > > 
> > > w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
> > > 
> > > > 
> > > > I'd also point out that the lockdiscovery property MUST contain
> > > > all the lock tokens, regardless of access control settings.  This
> > > > is not considered a security leak, because authorization is also
> > > > needed to use a lock token.  So this is the server logic to apply
> > > > whenever the client provides a lock token: 
> > > > 
> > > > Is this the same authorization context that took out the lock? 
> > > >   Yes {
> > > >    Allow the operation normally, provided the operation is 
> > > >    allowed, and provided the lock token is correct and all
> > > >    required lock tokens are provided, etc.
> > > >   } No {
> > > >    Is this an UNLOCK operation, with an authorization that
> > > >    includes permission to delete others' locks?
> > > >    Yes {
> > > >       perform UNLOCK
> > > >    } No {
> > > >       Fail request
> > > >    }
> > > >   }
> > > > 
> > > > Lisa
> > > > 
> > > > > -----Original Message-----
> > > > > From: w3c-dist-auth-request@w3.org 
> > > > > [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> > > > > Sent: Wednesday, September 17, 2003 11:17 AM
> > > > > To: 'Horst Liermann'; w3c-dist-auth@w3.org
> > > > > Subject: RE: ACL and lockdiscovery
> > > > > 
> > > > > 
> > > > > 
> > > > > The ACL spec hasn't defined a privilege specifically to 
> > > > > control read access to the lockdiscovery property, or even a 
> > > > > privilege to control access to all the privileges in total. 
> > > > > An individual server implementation could provide such a 
> > > > > privilege and aggregate it under <dav:read>, but this isn't 
required.
> > > > > 
> > > > > --Eric
> > > > > 
> > > > > > -----Original Message-----
> > > > > > From: w3c-dist-auth-request@w3.org 
> > > > > > [mailto:w3c-dist-auth-request@w3.org]
> > > > > > On Behalf Of Horst Liermann
> > > > > > Sent: Wednesday, September 17, 2003 10:08 AM
> > > > > > To: 'w3c-dist-auth@w3.org'
> > > > > > 
> > > > > > 
> > > > > > Hi all,
> > > > > > 
> > > > > > some questions about lockdiscovery and ACL's
> > > > > > 
> > > > > > Suppose, you have a server with WebDAV ( including lock) and 
it 
> > > > > > support's ACL. What is the behavior for lockdiscovery, can 
> > > > > I see all 
> > > > > > lock token or am I only allowed to see the tokens where I 
> > > > > am the owner 
> > > > > > of the lock ? As far as I understand, lockdiscovery reports 
> > > > > all locks. 
> > > > > > Is this a security leak ?
> > > > > > 
> > > > > > Best Regards
> > > > > >    Horst
> > > > > 
> > > > > 
> > > > > 
> > > > 
> > > > 
--=_alternative 005BD4FE85256DA6_=
Content-Type: text/html; charset="US-ASCII"


<br><font size=2><tt>A compliant client should be prepared for the absence
of a lock token,</tt></font>
<br><font size=2><tt>since the DTD for DAV:activelock explicitly marks
it as being optional.</tt></font>
<br>
<br><font size=2><tt>But that of course doesn't answer Julian's actual
question, which is</tt></font>
<br><font size=2><tt>whether existing clients are correctly implemented
(:-).</tt></font>
<br><font size=2><tt><br>
Cheers,</tt></font>
<br><font size=2><tt>Geoff</tt></font>
<br>
<br><font size=2><tt>Julian wrote on 09/19/2003 12:10:36 PM:<br>
<br>
&gt; OK,</tt></font>
<br><font size=2><tt>&gt; &nbsp;</tt></font>
<br><font size=2><tt>&gt; so what's the best interoperable way to hide
the lock token? Simply <br>
&gt; leaving out the locktoken/href element, or supplying a dummy (such
<br>
&gt; as &quot;DAV:private&quot;) instead? Does any currently deployed server
do this already?</tt></font>
<br><font size=2><tt>&gt; &nbsp;</tt></font>
<br><font size=2><tt>&gt; Julian</tt></font>
<br><font size=2><tt>&gt; --<br>
&gt; &lt;green/&gt;bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
</tt></font>
<br><font size=2><tt>&gt; -----Original Message-----<br>
&gt; From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]<br>
&gt; On Behalf Of Geoffrey M Clemm<br>
&gt; Sent: Friday, September 19, 2003 3:51 PM<br>
&gt; To: w3c-dist-auth@w3.org<br>
&gt; Subject: RE: ACL and lockdiscovery<br>
</tt></font>
<br><font size=2><tt>&gt; <br>
&gt; Just to be clear, I was in no way advocating that the presence <br>
&gt; of the lock itself should be hidden. &nbsp;I was just indicating the
<br>
&gt; cases when the suppression of the *lock-token* field in the <br>
&gt; lock-discovery data is likely to be desireable. <br>
&gt; <br>
&gt; Cheers, <br>
&gt; Geoff <br>
&gt; <br>
&gt; w3c-dist-auth-request@w3.org wrote on 09/19/2003 09:26:50 AM:<br>
&gt; <br>
&gt; &gt; I basically agree with Geoff. <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; However there's the legitamite use case that a UI needs to get
the <br>
&gt; &gt; active locks just in order to be able to display whether a resource
<br>
&gt; &gt; is locked or not. So maybe we should think of a way that handles
<br>
&gt; &gt; this case, without having to reveal &quot;too much&quot;. <br>
&gt; &gt; &nbsp; <br>
&gt; &gt; Julian <br>
&gt; &gt; --<br>
&gt; &gt; &lt;green/&gt;bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
<br>
&gt; &gt; -----Original Message-----<br>
&gt; &gt; From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]<br>
&gt; &gt; On Behalf Of Geoffrey M Clemm<br>
&gt; &gt; Sent: Friday, September 19, 2003 3:19 PM<br>
&gt; &gt; To: w3c-dist-auth@w3.org<br>
&gt; &gt; Subject: RE: ACL and lockdiscovery<br>
&gt; <br>
&gt; &gt; <br>
&gt; &gt; If the client doesn't have permission to do an UNLOCK, <br>
&gt; &gt; or if the lock automatically times out <br>
&gt; &gt; (the two use cases identified where the server is likely to withhold
<br>
&gt; &gt; the lock token), the client either cannot do an UNLOCK, or does
not <br>
&gt; &gt; need to do an UNLOCK. <br>
&gt; &gt; <br>
&gt; &gt; WRT clients that do not store the lock tokens, but rather try
to steal <br>
&gt; &gt; any lock token that is allowed by access control, this violates
the whole <br>
&gt; &gt; point of having lock tokens instead of just a server-side lock
(i.<br>
&gt; e.preventing<br>
&gt; &gt; two clients working on behalf of the same user from stomping
on <br>
&gt; each other), <br>
&gt; &gt; and such a client should be fixed, not catered to by servers.
<br>
&gt; &gt; <br>
&gt; &gt; Cheers, <br>
&gt; &gt; Geoff <br>
&gt; &gt; <br>
&gt; &gt; &quot;Lisa Dusseault&quot; &lt;lisa@xythos.com&gt; wrote on 09/18/2003
12:32:20 PM:<br>
&gt; &gt; <br>
&gt; &gt; &gt; Unfortunately, withholding the locktoken from the client
that <br>
&gt; &gt; &gt; requested that lock <br>
&gt; &gt; &gt; would break UNLOCK for some clients that don't store their
own <br>
&gt; lock tokens.<br>
&gt; &gt; &gt; Those clients might show error messages &amp; cause support
calls. <br>
&gt; &gt; &gt; Thus, as a matter of interoperability, a server would at
least have to <br>
&gt; &gt; &gt; be careful in providing incomplete information in lockdiscovery.
<br>
&gt; &gt; &gt; &nbsp; <br>
&gt; &gt; &gt; This area is murkier than I had thought. &nbsp;Should there
be a <br>
&gt; clarification in<br>
&gt; &gt; &gt; RFC2518bis? It would obviously be easier to write interoperable
clients <br>
&gt; &gt; &gt; if all servers had to behave the same in this area. &nbsp;Is
there a de facto <br>
&gt; &gt; &gt; minimum standard here that we can clarify in the next rev?
<br>
&gt; &gt; &gt; &nbsp; <br>
&gt; &gt; &gt; lisa <br>
&gt; &gt; &gt; -----Original Message-----<br>
&gt; &gt; &gt; From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]
<br>
&gt; &gt; &gt; On Behalf Of Geoffrey M Clemm<br>
&gt; &gt; &gt; Sent: Thursday, September 18, 2003 5:17 AM<br>
&gt; &gt; &gt; To: w3c-dist-auth@w3.org<br>
&gt; &gt; &gt; Subject: RE: ACL and lockdiscovery<br>
&gt; &gt; <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; That is not correct. &nbsp;RFC-2518 explicitly states in
<br>
&gt; &gt; &gt; section 13.8 (where the DAV:lockdiscovery property is defined):
<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; &quot;The server is free to withhold any or all of this
information <br>
&gt; &gt; &gt; if the requesting principal does not have sufficient access
rights <br>
&gt; &gt; &gt; to see the requested data.&quot; <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; In particular, if the client does not have sufficient access
<br>
&gt; &gt; &gt; rights to UNLOCK the resource, a server could very reasonably
<br>
&gt; &gt; &gt; choose to hide the lock-token information. <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; In addition, a server for which locks have a reasonably
<br>
&gt; &gt; &gt; short maximum expiration may chose to never expose the lock
tokens <br>
&gt; &gt; &gt; (i.e. nobody has sufficient access rights to see the lock
tokens). <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; Cheers, <br>
&gt; &gt; &gt; Geoff <br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20
PM:<br>
&gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; I'd also point out that the lockdiscovery property
MUST contain<br>
&gt; &gt; &gt; &gt; all the lock tokens, regardless of access control settings.
&nbsp;This<br>
&gt; &gt; &gt; &gt; is not considered a security leak, because authorization
is also<br>
&gt; &gt; &gt; &gt; needed to use a lock token. &nbsp;So this is the server
logic to apply<br>
&gt; &gt; &gt; &gt; whenever the client provides a lock token: <br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; Is this the same authorization context that took out
the lock? <br>
&gt; &gt; &gt; &gt; &nbsp; Yes {<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;Allow the operation normally, provided
the operation is <br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;allowed, and provided the lock token is
correct and all<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;required lock tokens are provided, etc.<br>
&gt; &gt; &gt; &gt; &nbsp; } No {<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;Is this an UNLOCK operation, with an authorization
that<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;includes permission to delete others'
locks?<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;Yes {<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp; &nbsp; perform UNLOCK<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;} No {<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp; &nbsp; Fail request<br>
&gt; &gt; &gt; &gt; &nbsp; &nbsp;}<br>
&gt; &gt; &gt; &gt; &nbsp; }<br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; Lisa<br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; -----Original Message-----<br>
&gt; &gt; &gt; &gt; &gt; From: w3c-dist-auth-request@w3.org <br>
&gt; &gt; &gt; &gt; &gt; [mailto:w3c-dist-auth-request@w3.org] On Behalf
Of Eric Sedlar<br>
&gt; &gt; &gt; &gt; &gt; Sent: Wednesday, September 17, 2003 11:17 AM<br>
&gt; &gt; &gt; &gt; &gt; To: 'Horst Liermann'; w3c-dist-auth@w3.org<br>
&gt; &gt; &gt; &gt; &gt; Subject: RE: ACL and lockdiscovery<br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; The ACL spec hasn't defined a privilege specifically
to <br>
&gt; &gt; &gt; &gt; &gt; control read access to the lockdiscovery property,
or even a <br>
&gt; &gt; &gt; &gt; &gt; privilege to control access to all the privileges
in total. &nbsp;<br>
&gt; &gt; &gt; &gt; &gt; An individual server implementation could provide
such a <br>
&gt; &gt; &gt; &gt; &gt; privilege and aggregate it under &lt;dav:read&gt;,
but this isn't required.<br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; --Eric<br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; &gt; -----Original Message-----<br>
&gt; &gt; &gt; &gt; &gt; &gt; From: w3c-dist-auth-request@w3.org <br>
&gt; &gt; &gt; &gt; &gt; &gt; [mailto:w3c-dist-auth-request@w3.org]<br>
&gt; &gt; &gt; &gt; &gt; &gt; On Behalf Of Horst Liermann<br>
&gt; &gt; &gt; &gt; &gt; &gt; Sent: Wednesday, September 17, 2003 10:08
AM<br>
&gt; &gt; &gt; &gt; &gt; &gt; To: 'w3c-dist-auth@w3.org'<br>
&gt; &gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; &gt; Hi all,<br>
&gt; &gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; &gt; some questions about lockdiscovery and ACL's<br>
&gt; &gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; &gt; Suppose, you have a server with WebDAV (
including lock) and it <br>
&gt; &gt; &gt; &gt; &gt; &gt; support's ACL. What is the behavior for lockdiscovery,
can <br>
&gt; &gt; &gt; &gt; &gt; I see all <br>
&gt; &gt; &gt; &gt; &gt; &gt; lock token or am I only allowed to see the
tokens where I <br>
&gt; &gt; &gt; &gt; &gt; am the owner <br>
&gt; &gt; &gt; &gt; &gt; &gt; of the lock ? As far as I understand, lockdiscovery
reports <br>
&gt; &gt; &gt; &gt; &gt; all locks. <br>
&gt; &gt; &gt; &gt; &gt; &gt; Is this a security leak ?<br>
&gt; &gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; &gt; Best Regards<br>
&gt; &gt; &gt; &gt; &gt; &gt; &nbsp; &nbsp;Horst<br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; <br>
&gt; &gt; &gt; &gt; </tt></font>
--=_alternative 005BD4FE85256DA6_=--



From w3c-dist-auth-request@w3.org  Fri Sep 19 13:12:16 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15244
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 13:12:16 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id E10B6A059C; Fri, 19 Sep 2003 13:12:23 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 139F1A059C
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 13:12:19 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id A8634137D2; Fri, 19 Sep 2003 13:12:18 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (pop.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id EB5EE13714
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 13:12:17 -0400 (EDT)
Received: (qmail 25293 invoked by uid 65534); 19 Sep 2003 17:11:58 -0000
Received: from pD950C274.dip.t-dialin.net (HELO lisa) (217.80.194.116)
  by mail.gmx.net (mp014) with SMTP; 19 Sep 2003 19:11:58 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Geoffrey M Clemm" <geoffrey.clemm@us.ibm.com>, <w3c-dist-auth@w3.org>
Date: Fri, 19 Sep 2003 19:11:53 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCAEHDIIAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0008_01C37EE1.E3132550"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
In-Reply-To: <OF2267EE8F.A091BDE4-ON85256DA6.005B7AE6-85256DA6.005BDA1A@us.ibm.com>
Importance: Normal
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCAEHDIIAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7894
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919171223.E10B6A059C@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 13:12:23 -0400 (EDT)


This is a multi-part message in MIME format.

------=_NextPart_000_0008_01C37EE1.E3132550
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Indeed.

I wasn't aware about the optionality of the lock token. Another interesting
client test case :-)

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

  -----Original Message-----
  From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]On
Behalf Of Geoffrey M Clemm
  Sent: Friday, September 19, 2003 6:43 PM
  To: w3c-dist-auth@w3.org
  Subject: RE: ACL and lockdiscovery



  A compliant client should be prepared for the absence of a lock token,
  since the DTD for DAV:activelock explicitly marks it as being optional.

  But that of course doesn't answer Julian's actual question, which is
  whether existing clients are correctly implemented (:-).

  Cheers,
  Geoff

  Julian wrote on 09/19/2003 12:10:36 PM:

  > OK,
  >
  > so what's the best interoperable way to hide the lock token? Simply
  > leaving out the locktoken/href element, or supplying a dummy (such
  > as "DAV:private") instead? Does any currently deployed server do this
already?
  >
  > Julian
  > --
  > <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
  > -----Original Message-----
  > From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org]
  > On Behalf Of Geoffrey M Clemm
  > Sent: Friday, September 19, 2003 3:51 PM
  > To: w3c-dist-auth@w3.org
  > Subject: RE: ACL and lockdiscovery

  >
  > Just to be clear, I was in no way advocating that the presence
  > of the lock itself should be hidden.  I was just indicating the
  > cases when the suppression of the *lock-token* field in the
  > lock-discovery data is likely to be desireable.
  >
  > Cheers,
  > Geoff
  >
  > w3c-dist-auth-request@w3.org wrote on 09/19/2003 09:26:50 AM:
  >
  > > I basically agree with Geoff.
  > >
  > > However there's the legitamite use case that a UI needs to get the
  > > active locks just in order to be able to display whether a resource
  > > is locked or not. So maybe we should think of a way that handles
  > > this case, without having to reveal "too much".
  > >
  > > Julian
  > > --
  > > <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
  > > -----Original Message-----
  > > From: w3c-dist-auth-request@w3.org
[mailto:w3c-dist-auth-request@w3.org]
  > > On Behalf Of Geoffrey M Clemm
  > > Sent: Friday, September 19, 2003 3:19 PM
  > > To: w3c-dist-auth@w3.org
  > > Subject: RE: ACL and lockdiscovery
  >
  > >
  > > If the client doesn't have permission to do an UNLOCK,
  > > or if the lock automatically times out
  > > (the two use cases identified where the server is likely to withhold
  > > the lock token), the client either cannot do an UNLOCK, or does not
  > > need to do an UNLOCK.
  > >
  > > WRT clients that do not store the lock tokens, but rather try to steal
  > > any lock token that is allowed by access control, this violates the
whole
  > > point of having lock tokens instead of just a server-side lock (i.
  > e.preventing
  > > two clients working on behalf of the same user from stomping on
  > each other),
  > > and such a client should be fixed, not catered to by servers.
  > >
  > > Cheers,
  > > Geoff
  > >
  > > "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003 12:32:20 PM:
  > >
  > > > Unfortunately, withholding the locktoken from the client that
  > > > requested that lock
  > > > would break UNLOCK for some clients that don't store their own
  > lock tokens.
  > > > Those clients might show error messages & cause support calls.
  > > > Thus, as a matter of interoperability, a server would at least have
to
  > > > be careful in providing incomplete information in lockdiscovery.
  > > >
  > > > This area is murkier than I had thought.  Should there be a
  > clarification in
  > > > RFC2518bis? It would obviously be easier to write interoperable
clients
  > > > if all servers had to behave the same in this area.  Is there a de
facto
  > > > minimum standard here that we can clarify in the next rev?
  > > >
  > > > lisa
  > > > -----Original Message-----
  > > > From: w3c-dist-auth-request@w3.org
[mailto:w3c-dist-auth-request@w3.org]
  > > > On Behalf Of Geoffrey M Clemm
  > > > Sent: Thursday, September 18, 2003 5:17 AM
  > > > To: w3c-dist-auth@w3.org
  > > > Subject: RE: ACL and lockdiscovery
  > >
  > > >
  > > > That is not correct.  RFC-2518 explicitly states in
  > > > section 13.8 (where the DAV:lockdiscovery property is defined):
  > > >
  > > > "The server is free to withhold any or all of this information
  > > > if the requesting principal does not have sufficient access rights
  > > > to see the requested data."
  > > >
  > > > In particular, if the client does not have sufficient access
  > > > rights to UNLOCK the resource, a server could very reasonably
  > > > choose to hide the lock-token information.
  > > >
  > > > In addition, a server for which locks have a reasonably
  > > > short maximum expiration may chose to never expose the lock tokens
  > > > (i.e. nobody has sufficient access rights to see the lock tokens).
  > > >
  > > > Cheers,
  > > > Geoff
  > > >
  > > > w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
  > > >
  > > > >
  > > > > I'd also point out that the lockdiscovery property MUST contain
  > > > > all the lock tokens, regardless of access control settings.  This
  > > > > is not considered a security leak, because authorization is also
  > > > > needed to use a lock token.  So this is the server logic to apply
  > > > > whenever the client provides a lock token:
  > > > >
  > > > > Is this the same authorization context that took out the lock?
  > > > >   Yes {
  > > > >    Allow the operation normally, provided the operation is
  > > > >    allowed, and provided the lock token is correct and all
  > > > >    required lock tokens are provided, etc.
  > > > >   } No {
  > > > >    Is this an UNLOCK operation, with an authorization that
  > > > >    includes permission to delete others' locks?
  > > > >    Yes {
  > > > >       perform UNLOCK
  > > > >    } No {
  > > > >       Fail request
  > > > >    }
  > > > >   }
  > > > >
  > > > > Lisa
  > > > >
  > > > > > -----Original Message-----
  > > > > > From: w3c-dist-auth-request@w3.org
  > > > > > [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
  > > > > > Sent: Wednesday, September 17, 2003 11:17 AM
  > > > > > To: 'Horst Liermann'; w3c-dist-auth@w3.org
  > > > > > Subject: RE: ACL and lockdiscovery
  > > > > >
  > > > > >
  > > > > >
  > > > > > The ACL spec hasn't defined a privilege specifically to
  > > > > > control read access to the lockdiscovery property, or even a
  > > > > > privilege to control access to all the privileges in total.
  > > > > > An individual server implementation could provide such a
  > > > > > privilege and aggregate it under <dav:read>, but this isn't
required.
  > > > > >
  > > > > > --Eric
  > > > > >
  > > > > > > -----Original Message-----
  > > > > > > From: w3c-dist-auth-request@w3.org
  > > > > > > [mailto:w3c-dist-auth-request@w3.org]
  > > > > > > On Behalf Of Horst Liermann
  > > > > > > Sent: Wednesday, September 17, 2003 10:08 AM
  > > > > > > To: 'w3c-dist-auth@w3.org'
  > > > > > >
  > > > > > >
  > > > > > > Hi all,
  > > > > > >
  > > > > > > some questions about lockdiscovery and ACL's
  > > > > > >
  > > > > > > Suppose, you have a server with WebDAV ( including lock) and
it
  > > > > > > support's ACL. What is the behavior for lockdiscovery, can
  > > > > > I see all
  > > > > > > lock token or am I only allowed to see the tokens where I
  > > > > > am the owner
  > > > > > > of the lock ? As far as I understand, lockdiscovery reports
  > > > > > all locks.
  > > > > > > Is this a security leak ?
  > > > > > >
  > > > > > > Best Regards
  > > > > > >    Horst
  > > > > >
  > > > > >
  > > > > >
  > > > >
  > > > >

------=_NextPart_000_0008_01C37EE1.E3132550
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Dus-ascii">
<META content=3D"MSHTML 6.00.2800.1226" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D386211117-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>Indeed.</FONT></SPAN></DIV>
<DIV><SPAN class=3D386211117-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D386211117-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>I wasn't aware about the optionality of the lock token. Another =

interesting client test case :-)</FONT></SPAN></DIV>
<DIV>&nbsp;</DIV>
<P><FONT size=3D2>--<BR>&lt;green/&gt;bytes GmbH -- <A=20
href=3D"http://www.greenbytes.de/" =
target=3D_blank>http://www.greenbytes.de</A> --=20
tel:+492512807760 </FONT></P>
<BLOCKQUOTE=20
style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px =
solid">
  <DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
  size=3D2>-----Original Message-----<BR><B>From:</B> =
w3c-dist-auth-request@w3.org=20
  [mailto:w3c-dist-auth-request@w3.org]<B>On Behalf Of </B>Geoffrey M=20
  Clemm<BR><B>Sent:</B> Friday, September 19, 2003 6:43 PM<BR><B>To:</B> =

  w3c-dist-auth@w3.org<BR><B>Subject:</B> RE: ACL and=20
  lockdiscovery<BR><BR></FONT></DIV><BR><FONT size=3D2><TT>A compliant =
client=20
  should be prepared for the absence of a lock token,</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>since the DTD for DAV:activelock explicitly marks it as =
being=20
  optional.</TT></FONT> <BR><BR><FONT size=3D2><TT>But that of course =
doesn't=20
  answer Julian's actual question, which is</TT></FONT> <BR><FONT=20
  size=3D2><TT>whether existing clients are correctly implemented=20
  (:-).</TT></FONT> <BR><FONT size=3D2><TT><BR>Cheers,</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>Geoff</TT></FONT> <BR><BR><FONT size=3D2><TT>Julian wrote =
on=20
  09/19/2003 12:10:36 PM:<BR><BR>&gt; OK,</TT></FONT> <BR><FONT =
size=3D2><TT>&gt;=20
  &nbsp;</TT></FONT> <BR><FONT size=3D2><TT>&gt; so what's the best =
interoperable=20
  way to hide the lock token? Simply <BR>&gt; leaving out the =
locktoken/href=20
  element, or supplying a dummy (such <BR>&gt; as "DAV:private") =
instead? Does=20
  any currently deployed server do this already?</TT></FONT> <BR><FONT=20
  size=3D2><TT>&gt; &nbsp;</TT></FONT> <BR><FONT size=3D2><TT>&gt;=20
  Julian</TT></FONT> <BR><FONT size=3D2><TT>&gt; --<BR>&gt; =
&lt;green/&gt;bytes=20
  GmbH -- http://www.greenbytes.de -- tel:+492512807760 =
</TT></FONT><BR><FONT=20
  size=3D2><TT>&gt; -----Original Message-----<BR>&gt; From:=20
  w3c-dist-auth-request@w3.org =
[mailto:w3c-dist-auth-request@w3.org]<BR>&gt; On=20
  Behalf Of Geoffrey M Clemm<BR>&gt; Sent: Friday, September 19, 2003 =
3:51=20
  PM<BR>&gt; To: w3c-dist-auth@w3.org<BR>&gt; Subject: RE: ACL and=20
  lockdiscovery<BR></TT></FONT><BR><FONT size=3D2><TT>&gt; <BR>&gt; Just =
to be=20
  clear, I was in no way advocating that the presence <BR>&gt; of the =
lock=20
  itself should be hidden. &nbsp;I was just indicating the <BR>&gt; =
cases when=20
  the suppression of the *lock-token* field in the <BR>&gt; =
lock-discovery data=20
  is likely to be desireable. <BR>&gt; <BR>&gt; Cheers, <BR>&gt; Geoff =
<BR>&gt;=20
  <BR>&gt; w3c-dist-auth-request@w3.org wrote on 09/19/2003 09:26:50 =
AM:<BR>&gt;=20
  <BR>&gt; &gt; I basically agree with Geoff. <BR>&gt; &gt; &nbsp; =
<BR>&gt; &gt;=20
  However there's the legitamite use case that a UI needs to get the =
<BR>&gt;=20
  &gt; active locks just in order to be able to display whether a =
resource=20
  <BR>&gt; &gt; is locked or not. So maybe we should think of a way that =
handles=20
  <BR>&gt; &gt; this case, without having to reveal "too much". <BR>&gt; =
&gt;=20
  &nbsp; <BR>&gt; &gt; Julian <BR>&gt; &gt; --<BR>&gt; &gt; =
&lt;green/&gt;bytes=20
  GmbH -- http://www.greenbytes.de -- tel:+492512807760 <BR>&gt; &gt;=20
  -----Original Message-----<BR>&gt; &gt; From: =
w3c-dist-auth-request@w3.org=20
  [mailto:w3c-dist-auth-request@w3.org]<BR>&gt; &gt; On Behalf Of =
Geoffrey M=20
  Clemm<BR>&gt; &gt; Sent: Friday, September 19, 2003 3:19 PM<BR>&gt; =
&gt; To:=20
  w3c-dist-auth@w3.org<BR>&gt; &gt; Subject: RE: ACL and =
lockdiscovery<BR>&gt;=20
  <BR>&gt; &gt; <BR>&gt; &gt; If the client doesn't have permission to =
do an=20
  UNLOCK, <BR>&gt; &gt; or if the lock automatically times out <BR>&gt; =
&gt;=20
  (the two use cases identified where the server is likely to withhold =
<BR>&gt;=20
  &gt; the lock token), the client either cannot do an UNLOCK, or does =
not=20
  <BR>&gt; &gt; need to do an UNLOCK. <BR>&gt; &gt; <BR>&gt; &gt; WRT =
clients=20
  that do not store the lock tokens, but rather try to steal <BR>&gt; =
&gt; any=20
  lock token that is allowed by access control, this violates the whole =
<BR>&gt;=20
  &gt; point of having lock tokens instead of just a server-side lock=20
  (i.<BR>&gt; e.preventing<BR>&gt; &gt; two clients working on behalf of =
the=20
  same user from stomping on <BR>&gt; each other), <BR>&gt; &gt; and =
such a=20
  client should be fixed, not catered to by servers. <BR>&gt; &gt; =
<BR>&gt; &gt;=20
  Cheers, <BR>&gt; &gt; Geoff <BR>&gt; &gt; <BR>&gt; &gt; "Lisa =
Dusseault"=20
  &lt;lisa@xythos.com&gt; wrote on 09/18/2003 12:32:20 PM:<BR>&gt; &gt; =
<BR>&gt;=20
  &gt; &gt; Unfortunately, withholding the locktoken from the client =
that=20
  <BR>&gt; &gt; &gt; requested that lock <BR>&gt; &gt; &gt; would break =
UNLOCK=20
  for some clients that don't store their own <BR>&gt; lock =
tokens.<BR>&gt; &gt;=20
  &gt; Those clients might show error messages &amp; cause support =
calls.=20
  <BR>&gt; &gt; &gt; Thus, as a matter of interoperability, a server =
would at=20
  least have to <BR>&gt; &gt; &gt; be careful in providing incomplete=20
  information in lockdiscovery. <BR>&gt; &gt; &gt; &nbsp; <BR>&gt; &gt; =
&gt;=20
  This area is murkier than I had thought. &nbsp;Should there be a =
<BR>&gt;=20
  clarification in<BR>&gt; &gt; &gt; RFC2518bis? It would obviously be =
easier to=20
  write interoperable clients <BR>&gt; &gt; &gt; if all servers had to =
behave=20
  the same in this area. &nbsp;Is there a de facto <BR>&gt; &gt; &gt; =
minimum=20
  standard here that we can clarify in the next rev? <BR>&gt; &gt; &gt; =
&nbsp;=20
  <BR>&gt; &gt; &gt; lisa <BR>&gt; &gt; &gt; -----Original =
Message-----<BR>&gt;=20
  &gt; &gt; From: w3c-dist-auth-request@w3.org=20
  [mailto:w3c-dist-auth-request@w3.org] <BR>&gt; &gt; &gt; On Behalf Of =
Geoffrey=20
  M Clemm<BR>&gt; &gt; &gt; Sent: Thursday, September 18, 2003 5:17 =
AM<BR>&gt;=20
  &gt; &gt; To: w3c-dist-auth@w3.org<BR>&gt; &gt; &gt; Subject: RE: ACL =
and=20
  lockdiscovery<BR>&gt; &gt; <BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; That =
is not=20
  correct. &nbsp;RFC-2518 explicitly states in <BR>&gt; &gt; &gt; =
section 13.8=20
  (where the DAV:lockdiscovery property is defined): <BR>&gt; &gt; &gt; =
<BR>&gt;=20
  &gt; &gt; "The server is free to withhold any or all of this =
information=20
  <BR>&gt; &gt; &gt; if the requesting principal does not have =
sufficient access=20
  rights <BR>&gt; &gt; &gt; to see the requested data." <BR>&gt; &gt; =
&gt;=20
  <BR>&gt; &gt; &gt; In particular, if the client does not have =
sufficient=20
  access <BR>&gt; &gt; &gt; rights to UNLOCK the resource, a server =
could very=20
  reasonably <BR>&gt; &gt; &gt; choose to hide the lock-token =
information.=20
  <BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; In addition, a server for which =
locks=20
  have a reasonably <BR>&gt; &gt; &gt; short maximum expiration may =
chose to=20
  never expose the lock tokens <BR>&gt; &gt; &gt; (i.e. nobody has =
sufficient=20
  access rights to see the lock tokens). <BR>&gt; &gt; &gt; <BR>&gt; =
&gt; &gt;=20
  Cheers, <BR>&gt; &gt; &gt; Geoff <BR>&gt; &gt; &gt; <BR>&gt; &gt; &gt; =

  w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:<BR>&gt; =
&gt;=20
  &gt; <BR>&gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; I'd also point =
out that=20
  the lockdiscovery property MUST contain<BR>&gt; &gt; &gt; &gt; all the =
lock=20
  tokens, regardless of access control settings. &nbsp;This<BR>&gt; &gt; =
&gt;=20
  &gt; is not considered a security leak, because authorization is =
also<BR>&gt;=20
  &gt; &gt; &gt; needed to use a lock token. &nbsp;So this is the server =
logic=20
  to apply<BR>&gt; &gt; &gt; &gt; whenever the client provides a lock =
token:=20
  <BR>&gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; Is this the same =
authorization=20
  context that took out the lock? <BR>&gt; &gt; &gt; &gt; &nbsp; Yes =
{<BR>&gt;=20
  &gt; &gt; &gt; &nbsp; &nbsp;Allow the operation normally, provided the =

  operation is <BR>&gt; &gt; &gt; &gt; &nbsp; &nbsp;allowed, and =
provided the=20
  lock token is correct and all<BR>&gt; &gt; &gt; &gt; &nbsp; =
&nbsp;required=20
  lock tokens are provided, etc.<BR>&gt; &gt; &gt; &gt; &nbsp; } No =
{<BR>&gt;=20
  &gt; &gt; &gt; &nbsp; &nbsp;Is this an UNLOCK operation, with an =
authorization=20
  that<BR>&gt; &gt; &gt; &gt; &nbsp; &nbsp;includes permission to delete =
others'=20
  locks?<BR>&gt; &gt; &gt; &gt; &nbsp; &nbsp;Yes {<BR>&gt; &gt; &gt; =
&gt; &nbsp;=20
  &nbsp; &nbsp; perform UNLOCK<BR>&gt; &gt; &gt; &gt; &nbsp; &nbsp;} No=20
  {<BR>&gt; &gt; &gt; &gt; &nbsp; &nbsp; &nbsp; Fail request<BR>&gt; =
&gt; &gt;=20
  &gt; &nbsp; &nbsp;}<BR>&gt; &gt; &gt; &gt; &nbsp; }<BR>&gt; &gt; &gt; =
&gt;=20
  <BR>&gt; &gt; &gt; &gt; Lisa<BR>&gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; =
&gt;=20
  &gt; -----Original Message-----<BR>&gt; &gt; &gt; &gt; &gt; From:=20
  w3c-dist-auth-request@w3.org <BR>&gt; &gt; &gt; &gt; &gt;=20
  [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar<BR>&gt; =
&gt;=20
  &gt; &gt; &gt; Sent: Wednesday, September 17, 2003 11:17 AM<BR>&gt; =
&gt; &gt;=20
  &gt; &gt; To: 'Horst Liermann'; w3c-dist-auth@w3.org<BR>&gt; &gt; &gt; =
&gt;=20
  &gt; Subject: RE: ACL and lockdiscovery<BR>&gt; &gt; &gt; &gt; &gt; =
<BR>&gt;=20
  &gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; =
&gt; &gt;=20
  The ACL spec hasn't defined a privilege specifically to <BR>&gt; &gt; =
&gt;=20
  &gt; &gt; control read access to the lockdiscovery property, or even a =

  <BR>&gt; &gt; &gt; &gt; &gt; privilege to control access to all the =
privileges=20
  in total. &nbsp;<BR>&gt; &gt; &gt; &gt; &gt; An individual server=20
  implementation could provide such a <BR>&gt; &gt; &gt; &gt; &gt; =
privilege and=20
  aggregate it under &lt;dav:read&gt;, but this isn't required.<BR>&gt; =
&gt;=20
  &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; &gt; --Eric<BR>&gt; &gt; &gt; =
&gt; &gt;=20
  <BR>&gt; &gt; &gt; &gt; &gt; &gt; -----Original Message-----<BR>&gt; =
&gt; &gt;=20
  &gt; &gt; &gt; From: w3c-dist-auth-request@w3.org <BR>&gt; &gt; &gt; =
&gt; &gt;=20
  &gt; [mailto:w3c-dist-auth-request@w3.org]<BR>&gt; &gt; &gt; &gt; &gt; =
&gt; On=20
  Behalf Of Horst Liermann<BR>&gt; &gt; &gt; &gt; &gt; &gt; Sent: =
Wednesday,=20
  September 17, 2003 10:08 AM<BR>&gt; &gt; &gt; &gt; &gt; &gt; To:=20
  'w3c-dist-auth@w3.org'<BR>&gt; &gt; &gt; &gt; &gt; &gt; <BR>&gt; &gt; =
&gt;=20
  &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; &gt; &gt; Hi all,<BR>&gt; &gt; =
&gt;=20
  &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; &gt; &gt; some questions about=20
  lockdiscovery and ACL's<BR>&gt; &gt; &gt; &gt; &gt; &gt; <BR>&gt; &gt; =
&gt;=20
  &gt; &gt; &gt; Suppose, you have a server with WebDAV ( including =
lock) and it=20
  <BR>&gt; &gt; &gt; &gt; &gt; &gt; support's ACL. What is the behavior =
for=20
  lockdiscovery, can <BR>&gt; &gt; &gt; &gt; &gt; I see all <BR>&gt; =
&gt; &gt;=20
  &gt; &gt; &gt; lock token or am I only allowed to see the tokens where =
I=20
  <BR>&gt; &gt; &gt; &gt; &gt; am the owner <BR>&gt; &gt; &gt; &gt; &gt; =
&gt; of=20
  the lock ? As far as I understand, lockdiscovery reports <BR>&gt; &gt; =
&gt;=20
  &gt; &gt; all locks. <BR>&gt; &gt; &gt; &gt; &gt; &gt; Is this a =
security leak=20
  ?<BR>&gt; &gt; &gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; &gt; &gt; =
Best=20
  Regards<BR>&gt; &gt; &gt; &gt; &gt; &gt; &nbsp; &nbsp;Horst<BR>&gt; =
&gt; &gt;=20
  &gt; &gt; <BR>&gt; &gt; &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; &gt; =
<BR>&gt;=20
  &gt; &gt; &gt; <BR>&gt; &gt; &gt; &gt; =
</TT></FONT></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_0008_01C37EE1.E3132550--



From w3c-dist-auth-request@w3.org  Fri Sep 19 13:16:34 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA15492
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 13:16:34 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 49B9EA0882; Fri, 19 Sep 2003 13:16:35 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 851BAA0882
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 13:16:33 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 187581373D; Fri, 19 Sep 2003 13:16:33 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (pop.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 10FBA13699
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 13:16:32 -0400 (EDT)
Received: (qmail 20201 invoked by uid 65534); 19 Sep 2003 17:16:28 -0000
Received: from pD950C274.dip.t-dialin.net (HELO lisa) (217.80.194.116)
  by mail.gmx.net (mp001) with SMTP; 19 Sep 2003 19:16:28 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Geoffrey M Clemm" <geoffrey.clemm@us.ibm.com>,
        "'WebDAV List (E-mail)'" <w3c-dist-auth@w3.org>
Date: Fri, 19 Sep 2003 19:16:27 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCKEHDIIAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_000E_01C37EE2.85DFC810"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
In-Reply-To: <OF47E54395.BE099420-ON85256DA6.00587FD0-85256DA6.005B248B@us.ibm.com>
Importance: Normal
Subject: RE: multiple "source" properties documents
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCKEHDIIAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7895
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919171635.49B9EA0882@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 13:16:35 -0400 (EDT)


This is a multi-part message in MIME format.

------=_NextPart_000_000E_01C37EE2.85DFC810
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable

I see.

That makes sense, but definitively should be explained. As far as I =
remember, this is the very first time since I'm reading this list (2,5 =
years) that somebody was actually able to explain why this element is =
there.

So how do we proceed? Should we try to get it into RFC2518bis (which =
would require demonstrated interoperability), or should we try to come =
up with a separate document? Who is prepared to implement the property =
within the next few months?


Julian=20

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760=20

  -----Original Message-----
  From: w3c-dist-auth-request@w3.org =
[mailto:w3c-dist-auth-request@w3.org]On Behalf Of Geoffrey M Clemm
  Sent: Friday, September 19, 2003 6:36 PM
  To: 'WebDAV List (E-mail)'
  Subject: RE: multiple "source" properties documents



  I don't think the format needs to be changed, but it certainly=20
  would need to be more clearly described.  I am continually=20
  amazed at how such an otherwise sensible group of authors could have=20
  chosen a node named DAV:tgt to hold the URI of the source,=20
  and a node named DAV:src to hold the URI of what is usually the=20
  resource itself.  Didn't they at list flinch or grimace at=20
  the sentences:=20

  "The destination of the source link identifies the ... source=20
   of the link=E2=80=99s source."=20

  and=20

  "The source of the link is typically the URI of the resource=20
   on which the link is defined."=20

  One could make a good argument that this poor naming choice alone=20
  merits deprecating the feature :-).=20

  But back to your actual question, if there are multiple outputs=20
  of the processing step (i.e. it produces not only the resource=20
  identified by the request-URI, but several other resources),=20
  then it is useful to have the DAV:src nodes to indicate what=20
  those other output resources are.=20

  Cheers,=20
  Geoff=20

  Julian wrote on 09/19/2003 09:18:29 AM:

  > Geoff,=20
  >  =20
  > please re-read the old discussion on the mailing list. RFC2518=20
  > specifies a format that indeed doesn't make any sense (can you=20
  > explain what the DAV:src sub-element is for?).=20
  >  =20
  > So *if* this feature is to remain in RFC2518, at least the format=20
  > needs to be fixed (possibly in a way backwards compatible to =
RFC2518).=20
  >  =20
  > Julian=20
  > --
  > <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760=20
  > -----Original Message-----
  > From: w3c-dist-auth-request@w3.org =
[mailto:w3c-dist-auth-request@w3.org]
  > On Behalf Of Geoffrey M Clemm
  > Sent: Friday, September 19, 2003 3:06 PM
  > To: 'WebDAV List (E-mail)'
  > Subject: RE: multiple "source" properties documents

  >=20
  > My perspective is a bit different.  The DAV:source property=20
  > was designed for exactly the situation that Conal describes.=20
  > He'd like a generic application to pop up the list of URL's=20
  > and say "these are the sources".  There are no significant=20
  > testing issues ... the format of the DAV:source property is=20
  > well defined, and all a client is expected to do is to expose=20
  > the specified list of URL's.=20
  >=20
  > So in Conal's case, I'd just expose this feature using the=20
  > DAV:source property, and you are no worse off that if you=20
  > just defined your own custom property, and that if enough=20
  > folks do so, the property will become "undeprecated".=20
  >=20
  > Note: I am not arguing against deprecating the DAV:source=20
  > feature ... I don't think the topic is significant enough=20
  > to merit being re-opened ... I'm just saying that if you are=20
  > an implementor and encounter a valid use for the DAV:source=20
  > property, you should go ahead and use it instead of inventing=20
  > your own custom property, even if it is deprecated in 2518bis.=20
  >=20
  > Cheers,=20
  > Geoff=20
  >=20
  >=20
  > Lisa wrote on 09/18/2003 07:41:56 PM:
  >=20
  > >=20
  > >=20
  > > > From what I read, the "source" property was a great idea but=20
  > > > no-one ever implemented it, supposedly because it was too=20
  > > > complicated and/or there was no perceived need.=20
  > >=20
  > > I'd characterize the reasons a little differently:=20
  > >  1) The feature was underspecified, there was never enough=20
  > >    information in the spec to be able to fully implement
  > >    or interoperate
  > >  2) Implementation interest was low -- we asked around to see
  > >    who had implemented this feature and got no positive
  > >    responses at all.
  > >=20
  > > > Eventually it=20
  > > > was formally deprecated. Is this correct?=20
  > >=20
  > > The deprecation isn't final yet, but we are proposing to=20
  > > deprecate it.
  > >=20
  > > > I've also read of=20
  > > > the "translate" header, which I gather is a=20
  > > > Microsoft-specific extension? I also gather that this only=20
  > > > supports a one-to-one mapping between a document and its=20
  > > > source, i.e. a document has one and only one source?
  > >=20
  > > Yes
  > >=20
  > > > My case is that I have a server which generates pages from=20
  > > > multiple sources and keeps track of those sources in such a=20
  > > > way that it could fairly easily support dav:source. I'd like=20
  > > > editors to be able to edit the page and select which of the=20
  > > > source documents to edit. But are there existing clients that=20
  > > > will actually do that? Or are there other web-dav mechanisms=20
  > > > that might support my use-case?
  > >=20
  > > Not that I know of.  You'd be the first to implement a=20
  > > protocol feature to expose multiple mappings so nobody
  > > to interoperate with and no tools to support your feature.
  > >=20
  > > If there is sufficient interest from implementors to make
  > > forward progress on this, I'd recommend a separate draft rather
  > > than resurrect the unimplemented, underspecified, and untested
  > > feature in RFC2518.
  > >=20
  > > Lisa
  > >=20
  > > 
------=_NextPart_000_000E_01C37EE2.85DFC810
Content-Type: text/html;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable

=EF=BB=BF<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; charset=3Dutf-8">
<META content=3D"MSHTML 6.00.2800.1226" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D264041317-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>I see.</FONT></SPAN></DIV>
<DIV><SPAN class=3D264041317-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D264041317-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>That makes sense, but definitively should =
be&nbsp;explained.&nbsp;As far=20
as I remember, this is the very first time&nbsp;since I'm reading this =
list (2,5=20
years) that somebody was actually able to explain why this =
element&nbsp;is=20
there.</FONT></SPAN></DIV>
<DIV><SPAN class=3D264041317-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D264041317-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>So how do we proceed? Should we try to get it into RFC2518bis =
(which=20
would require demonstrated interoperability), or should we try to come =
up with a=20
separate document? Who is prepared to implement the property within the =
next few=20
months?</FONT></SPAN></DIV>
<DIV><SPAN class=3D264041317-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D264041317-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D264041317-19092003><FONT face=3D"Courier New" =
color=3D#0000ff=20
size=3D2>Julian</FONT>&nbsp;</SPAN></DIV>
<DIV>&nbsp;</DIV>
<P><FONT size=3D2>--<BR>&lt;green/&gt;bytes GmbH -- <A=20
href=3D"http://www.greenbytes.de/" =
target=3D_blank>http://www.greenbytes.de</A> --=20
tel:+492512807760 </FONT></P>
<BLOCKQUOTE=20
style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px =
solid">
  <DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
  size=3D2>-----Original Message-----<BR><B>From:</B> =
w3c-dist-auth-request@w3.org=20
  [mailto:w3c-dist-auth-request@w3.org]<B>On Behalf Of </B>Geoffrey M=20
  Clemm<BR><B>Sent:</B> Friday, September 19, 2003 6:36 PM<BR><B>To:</B> =
'WebDAV=20
  List (E-mail)'<BR><B>Subject:</B> RE: multiple "source" properties=20
  documents<BR><BR></FONT></DIV><BR><FONT size=3D2><TT>I don't think the =
format=20
  needs to be changed, but it certainly</TT></FONT> <BR><FONT =
size=3D2><TT>would=20
  need to be more clearly described. &nbsp;I am continually</TT></FONT>=20
  <BR><FONT size=3D2><TT>amazed at how such an otherwise sensible group =
of authors=20
  could have</TT></FONT> <BR><FONT size=3D2><TT>chosen a node named =
DAV:tgt to=20
  hold the URI of the source,</TT></FONT> <BR><FONT size=3D2><TT>and a =
node named=20
  DAV:src to hold the URI of what is usually the</TT></FONT> <BR><FONT=20
  size=3D2><TT>resource itself. &nbsp;Didn't they at list flinch or =
grimace=20
  at</TT></FONT> <BR><FONT size=3D2><TT>the sentences:</TT></FONT> =
<BR><BR><FONT=20
  size=3D2><TT>"The destination of the source link identifies the ...=20
  source</TT></FONT> <BR><FONT size=3D2><TT>&nbsp;of the link=E2=80=99s=20
  source."</TT></FONT> <BR><BR><FONT size=3D2><TT>and</TT></FONT> =
<BR><BR><FONT=20
  size=3D2><TT>"The source of the link is typically the URI of the=20
  resource</TT></FONT> <BR><FONT size=3D2><TT>&nbsp;on which the link is =

  defined."</TT></FONT> <BR><BR><FONT size=3D2><TT>One could make a good =
argument=20
  that this poor naming choice alone</TT></FONT> <BR><FONT =
size=3D2><TT>merits=20
  deprecating the feature :-).</TT></FONT> <BR><BR><FONT =
size=3D2><TT>But back to=20
  your actual question, if there are multiple outputs</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>of the processing step (i.e. it produces not only the=20
  resource</TT></FONT> <BR><FONT size=3D2><TT>identified by the =
request-URI, but=20
  several other resources),</TT></FONT> <BR><FONT size=3D2><TT>then it =
is useful=20
  to have the DAV:src nodes to indicate what </TT></FONT><BR><FONT=20
  size=3D2><TT>those other output resources are.</TT></FONT> =
<BR><BR><FONT=20
  size=3D2><TT>Cheers,</TT></FONT> <BR><FONT =
size=3D2><TT>Geoff</TT></FONT>=20
  <BR><BR><FONT size=3D2><TT>Julian wrote on 09/19/2003 09:18:29 =
AM:<BR><BR>&gt;=20
  Geoff,</TT></FONT> <BR><FONT size=3D2><TT>&gt; &nbsp;</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>&gt; please re-read the old discussion on the mailing =
list. RFC2518=20
  <BR>&gt; specifies a format that indeed doesn't make any sense (can =
you=20
  <BR>&gt; explain what the DAV:src sub-element is for?).</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>&gt; &nbsp;</TT></FONT> <BR><FONT size=3D2><TT>&gt; So =
*if* this=20
  feature is to remain in RFC2518, at least the format <BR>&gt; needs to =
be=20
  fixed (possibly in a way backwards compatible to RFC2518).</TT></FONT> =

  <BR><FONT size=3D2><TT>&gt; &nbsp;</TT></FONT> <BR><FONT =
size=3D2><TT>&gt;=20
  Julian</TT></FONT> <BR><FONT size=3D2><TT>&gt; --<BR>&gt; =
&lt;green/&gt;bytes=20
  GmbH -- http://www.greenbytes.de -- tel:+492512807760 =
</TT></FONT><BR><FONT=20
  size=3D2><TT>&gt; -----Original Message-----<BR>&gt; From:=20
  w3c-dist-auth-request@w3.org =
[mailto:w3c-dist-auth-request@w3.org]<BR>&gt; On=20
  Behalf Of Geoffrey M Clemm<BR>&gt; Sent: Friday, September 19, 2003 =
3:06=20
  PM<BR>&gt; To: 'WebDAV List (E-mail)'<BR>&gt; Subject: RE: multiple =
"source"=20
  properties documents<BR></TT></FONT><BR><FONT size=3D2><TT>&gt; =
<BR>&gt; My=20
  perspective is a bit different. &nbsp;The DAV:source property <BR>&gt; =
was=20
  designed for exactly the situation that Conal describes. <BR>&gt; He'd =
like a=20
  generic application to pop up the list of URL's <BR>&gt; and say =
"these are=20
  the sources". &nbsp;There are no significant <BR>&gt; testing issues =
... the=20
  format of the DAV:source property is <BR>&gt; well defined, and all a =
client=20
  is expected to do is to expose <BR>&gt; the specified list of URL's. =
<BR>&gt;=20
  <BR>&gt; So in Conal's case, I'd just expose this feature using the =
<BR>&gt;=20
  DAV:source property, and you are no worse off that if you <BR>&gt; =
just=20
  defined your own custom property, and that if enough <BR>&gt; folks do =
so, the=20
  property will become "undeprecated". <BR>&gt; <BR>&gt; Note: I am not =
arguing=20
  against deprecating the DAV:source <BR>&gt; feature ... I don't think =
the=20
  topic is significant enough <BR>&gt; to merit being re-opened ... I'm =
just=20
  saying that if you are <BR>&gt; an implementor and encounter a valid =
use for=20
  the DAV:source <BR>&gt; property, you should go ahead and use it =
instead of=20
  inventing <BR>&gt; your own custom property, even if it is deprecated =
in=20
  2518bis. <BR>&gt; <BR>&gt; Cheers, <BR>&gt; Geoff <BR>&gt; <BR>&gt; =
<BR>&gt;=20
  Lisa wrote on 09/18/2003 07:41:56 PM:<BR>&gt; <BR>&gt; &gt; <BR>&gt; =
&gt;=20
  <BR>&gt; &gt; &gt; From what I read, the "source" property was a great =
idea=20
  but <BR>&gt; &gt; &gt; no-one ever implemented it, supposedly because =
it was=20
  too <BR>&gt; &gt; &gt; complicated and/or there was no perceived need. =

  <BR>&gt; &gt; <BR>&gt; &gt; I'd characterize the reasons a little =
differently:=20
  <BR>&gt; &gt; &nbsp;1) The feature was underspecified, there was never =
enough=20
  <BR>&gt; &gt; &nbsp; &nbsp;information in the spec to be able to fully =

  implement<BR>&gt; &gt; &nbsp; &nbsp;or interoperate<BR>&gt; &gt; =
&nbsp;2)=20
  Implementation interest was low -- we asked around to see<BR>&gt; &gt; =
&nbsp;=20
  &nbsp;who had implemented this feature and got no positive<BR>&gt; =
&gt; &nbsp;=20
  &nbsp;responses at all.<BR>&gt; &gt; <BR>&gt; &gt; &gt; Eventually it =
<BR>&gt;=20
  &gt; &gt; was formally deprecated. Is this correct? <BR>&gt; &gt; =
<BR>&gt;=20
  &gt; The deprecation isn't final yet, but we are proposing to <BR>&gt; =
&gt;=20
  deprecate it.<BR>&gt; &gt; <BR>&gt; &gt; &gt; I've also read of =
<BR>&gt; &gt;=20
  &gt; the "translate" header, which I gather is a <BR>&gt; &gt; &gt;=20
  Microsoft-specific extension? I also gather that this only <BR>&gt; =
&gt; &gt;=20
  supports a one-to-one mapping between a document and its <BR>&gt; &gt; =
&gt;=20
  source, i.e. a document has one and only one source?<BR>&gt; &gt; =
<BR>&gt;=20
  &gt; Yes<BR>&gt; &gt; <BR>&gt; &gt; &gt; My case is that I have a =
server which=20
  generates pages from <BR>&gt; &gt; &gt; multiple sources and keeps =
track of=20
  those sources in such a <BR>&gt; &gt; &gt; way that it could fairly =
easily=20
  support dav:source. I'd like <BR>&gt; &gt; &gt; editors to be able to =
edit the=20
  page and select which of the <BR>&gt; &gt; &gt; source documents to =
edit. But=20
  are there existing clients that <BR>&gt; &gt; &gt; will actually do =
that? Or=20
  are there other web-dav mechanisms <BR>&gt; &gt; &gt; that might =
support my=20
  use-case?<BR>&gt; &gt; <BR>&gt; &gt; Not that I know of. &nbsp;You'd =
be the=20
  first to implement a <BR>&gt; &gt; protocol feature to expose multiple =

  mappings so nobody<BR>&gt; &gt; to interoperate with and no tools to =
support=20
  your feature.<BR>&gt; &gt; <BR>&gt; &gt; If there is sufficient =
interest from=20
  implementors to make<BR>&gt; &gt; forward progress on this, I'd =
recommend a=20
  separate draft rather<BR>&gt; &gt; than resurrect the unimplemented,=20
  underspecified, and untested<BR>&gt; &gt; feature in RFC2518.<BR>&gt; =
&gt;=20
  <BR>&gt; &gt; Lisa<BR>&gt; &gt; <BR>&gt; &gt;=20
</TT></FONT></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_000E_01C37EE2.85DFC810--



From w3c-dist-auth-request@w3.org  Fri Sep 19 15:56:32 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA20119
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 15:56:27 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 166FDA05FC; Fri, 19 Sep 2003 15:56:28 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 60FEAA05FC
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 15:56:25 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 1DA6F13638; Fri, 19 Sep 2003 15:56:25 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from e2.ny.us.ibm.com (e2.ny.us.ibm.com [32.97.182.102])
	by dr-nick.w3.org (Postfix) with ESMTP id 4EDC613598
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 15:56:21 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e2.ny.us.ibm.com (8.12.10/8.12.2) with ESMTP id h8JJuLXs187894
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 15:56:21 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h8JJuJOu203032
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 15:56:20 -0400
In-Reply-To: <006801c37ee4$7400d240$f8cb90c6@lisalap>
To: "'WebDAV List (E-mail)'" <w3c-dist-auth@w3.org>
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
Message-ID: <OF12E08A3F.FB9A8EDF-ON85256DA6.006D08D6-85256DA6.006D8757@us.ibm.com>
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Date: Fri, 19 Sep 2003 15:56:20 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/19/2003 15:56:20,
	Serialize complete at 09/19/2003 15:56:20
Content-Type: text/plain; charset="US-ASCII"
Subject: RE: multiple "source" properties documents
X-Archived-At: http://www.w3.org/mid/OF12E08A3F.FB9A8EDF-ON85256DA6.006D08D6-85256DA6.006D8757@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7897
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919195628.166FDA05FC@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 15:56:28 -0400 (EDT)


I agree that the property could be extended in a variety of 
interesting ways, but I do not consider that to imply that the
property is underspecified, but rather that the property is
appropriately extensible.   More comments below:

"Lisa Dusseault" <lisa@xythos.com> wrote on 09/19/2003 03:30:15 PM:

> It does seem reasonable to use the source property today insofar as 
> it can be used for simple cases.  It's a good bet that when 
> eventually enough implementors need the feature and work on the 
> specification, they can likely reuse the same property name. 
> However, the format within the property name could be significantly 
expanded.
> 
> Here are some of my reasons already posted for believing the 
> property is underspecified:
> http://lists.w3.org/Archives/Public/w3c-dist-auth/2002AprJun/0170.html
> 
> Other minor and major reasons why the source property is underspecified:
>  - Unlike other places where URLs appear in property values, URLs in
> the source property value are not shown in <href> tags.  Was this 
intentional?

I assume so, but I doubt there was a good reason for it.

>  - What do multiple 'link' elements mean semantically?

The link elements have no semantics beyond stating that the specified
DAV:dst resources are inputs to a process that creates the DAV:src
resources.  Extensions could provide more specific semantics, but this
general property would be enough to allow human users to do interesting
things with the information.

>  - Can the URL in 'dst', in a given source property value, be the 
> same URL that the source property appears on?  Can it be different?

Yes.  What is not forbidden is allowed.

>  - Is this property scalable?  Sharemation's WebUI runs on hundreds 
> of java files, with hundreds of java class files, a couple dozen 
> java libraries, hundreds of text files including resource files, and
> dozens of images.  Would the 'source' property for the URL 
> /xythoswfs/webui on www.sharemation.com really contain over a 
> thousand links plus information on how they tied together?  Since 
> some of these files can be changed without a recompile, would this 
> property have to be dynamically calculated?  By what process?  To 
> really handle this kind of situation, which isn't all that uncommon,
> the source property would have to point to some other authority or 
> way to browse source files.  Perhaps the source property could point
> to some directory hierarchy where the source files are all stored & 
> there would be more information within the properties of resources 
> in that hierarchy.

One could certainly introduce scalability extensions, but there are many
processes that only take a few resources as input and those would not
require these scalability extensions.

Cheers,
Geoff

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org] 

> On Behalf Of Geoffrey M Clemm
> Sent: Friday, September 19, 2003 6:06 AM
> To: 'WebDAV List (E-mail)'
> Subject: RE: multiple "source" properties documents

> 
> My perspective is a bit different.  The DAV:source property 
> was designed for exactly the situation that Conal describes. 
> He'd like a generic application to pop up the list of URL's 
> and say "these are the sources".  There are no significant 
> testing issues ... the format of the DAV:source property is 
> well defined, and all a client is expected to do is to expose 
> the specified list of URL's. 
> 
> So in Conal's case, I'd just expose this feature using the 
> DAV:source property, and you are no worse off that if you 
> just defined your own custom property, and that if enough 
> folks do so, the property will become "undeprecated". 
> 
> Note: I am not arguing against deprecating the DAV:source 
> feature ... I don't think the topic is significant enough 
> to merit being re-opened ... I'm just saying that if you are 
> an implementor and encounter a valid use for the DAV:source 
> property, you should go ahead and use it instead of inventing 
> your own custom property, even if it is deprecated in 2518bis. 
> 
> Cheers, 
> Geoff 
> 
> 
> Lisa wrote on 09/18/2003 07:41:56 PM:
> 
> > 
> > 
> > > From what I read, the "source" property was a great idea but 
> > > no-one ever implemented it, supposedly because it was too 
> > > complicated and/or there was no perceived need. 
> > 
> > I'd characterize the reasons a little differently: 
> >  1) The feature was underspecified, there was never enough 
> >    information in the spec to be able to fully implement
> >    or interoperate
> >  2) Implementation interest was low -- we asked around to see
> >    who had implemented this feature and got no positive
> >    responses at all.
> > 
> > > Eventually it 
> > > was formally deprecated. Is this correct? 
> > 
> > The deprecation isn't final yet, but we are proposing to 
> > deprecate it.
> > 
> > > I've also read of 
> > > the "translate" header, which I gather is a 
> > > Microsoft-specific extension? I also gather that this only 
> > > supports a one-to-one mapping between a document and its 
> > > source, i.e. a document has one and only one source?
> > 
> > Yes
> > 
> > > My case is that I have a server which generates pages from 
> > > multiple sources and keeps track of those sources in such a 
> > > way that it could fairly easily support dav:source. I'd like 
> > > editors to be able to edit the page and select which of the 
> > > source documents to edit. But are there existing clients that 
> > > will actually do that? Or are there other web-dav mechanisms 
> > > that might support my use-case?
> > 
> > Not that I know of.  You'd be the first to implement a 
> > protocol feature to expose multiple mappings so nobody
> > to interoperate with and no tools to support your feature.
> > 
> > If there is sufficient interest from implementors to make
> > forward progress on this, I'd recommend a separate draft rather
> > than resurrect the unimplemented, underspecified, and untested
> > feature in RFC2518.
> > 
> > Lisa
> > 
> > 



From w3c-dist-auth-request@w3.org  Fri Sep 19 16:00:24 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA20208
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 16:00:19 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 6DC5CA05DF; Fri, 19 Sep 2003 15:30:26 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id EB06FA05DF
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 15:30:23 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 8ECA013638; Fri, 19 Sep 2003 15:30:22 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id 2D24813439
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 15:30:22 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 1A0QxM-0007dA-00; Fri, 19 Sep 2003 19:30:16 +0000
Received: from [192.168.1.151] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 1A0QxL-0007cn-00; Fri, 19 Sep 2003 19:30:15 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: "'Geoffrey M Clemm'" <geoffrey.clemm@us.ibm.com>,
        "'WebDAV List (E-mail)'" <w3c-dist-auth@w3.org>
Date: Fri, 19 Sep 2003 12:30:15 -0700
Message-ID: <006801c37ee4$7400d240$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0069_01C37EA9.C7A1FA40"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
In-Reply-To: <OFFEB7615F.0603B9BD-ON85256DA6.0040F990-85256DA6.0047F1F3@us.ibm.com>
Old-X-Envelope-To: geoffrey.clemm@us.ibm.com,
 w3c-dist-auth@w3.org
Subject: RE: multiple "source" properties documents
X-Archived-At: http://www.w3.org/mid/006801c37ee4$7400d240$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7896
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030919193026.6DC5CA05DF@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 15:30:26 -0400 (EDT)


This is a multi-part message in MIME format.

------=_NextPart_000_0069_01C37EA9.C7A1FA40
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

It does seem reasonable to use the source property today insofar as it =
can
be used for simple cases.  It's a good bet that when eventually enough
implementors need the feature and work on the specification, they can =
likely
reuse the same property name.   However, the format within the property =
name
could be significantly expanded.
=20
Here are some of my reasons already posted for believing the property is
underspecified:
http://lists.w3.org/Archives/Public/w3c-dist-auth/2002AprJun/0170.html
=20
Other minor and major reasons why the source property is underspecified:
 - Unlike other places where URLs appear in property values, URLs in the
source property value are not shown in <href> tags.  Was this =
intentional?
 - What do multiple 'link' elements mean semantically?
 - Can the URL in 'dst', in a given source property value, be the same =
URL
that the source property appears on?  Can it be different?
 - Is this property scalable?  Sharemation's WebUI runs on hundreds of =
java
files, with hundreds of java class files, a couple dozen java libraries,
hundreds of text files including resource files, and dozens of images.
Would the 'source' property for the URL /xythoswfs/webui on
www.sharemation.com really contain over a thousand links plus =
information on
how they tied together?  Since some of these files can be changed =
without a
recompile, would this property have to be dynamically calculated?  By =
what
process?  To really handle this kind of situation, which isn't all that
uncommon, the source property would have to point to some other =
authority or
way to browse source files.  Perhaps the source property could point to =
some
directory hierarchy where the source files are all stored & there would =
be
more information within the properties of resources in that hierarchy.
=20
Lisa

-----Original Message-----
From: w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org] =
On
Behalf Of Geoffrey M Clemm
Sent: Friday, September 19, 2003 6:06 AM
To: 'WebDAV List (E-mail)'
Subject: RE: multiple "source" properties documents



My perspective is a bit different.  The DAV:source property=20
was designed for exactly the situation that Conal describes.=20
He'd like a generic application to pop up the list of URL's=20
and say "these are the sources".  There are no significant=20
testing issues ... the format of the DAV:source property is=20
well defined, and all a client is expected to do is to expose=20
the specified list of URL's.=20

So in Conal's case, I'd just expose this feature using the=20
DAV:source property, and you are no worse off that if you=20
just defined your own custom property, and that if enough=20
folks do so, the property will become "undeprecated".=20

Note: I am not arguing against deprecating the DAV:source=20
feature ... I don't think the topic is significant enough=20
to merit being re-opened ... I'm just saying that if you are=20
an implementor and encounter a valid use for the DAV:source=20
property, you should go ahead and use it instead of inventing=20
your own custom property, even if it is deprecated in 2518bis.=20

Cheers,=20
Geoff=20


Lisa wrote on 09/18/2003 07:41:56 PM:

>=20
>=20
> > From what I read, the "source" property was a great idea but=20
> > no-one ever implemented it, supposedly because it was too=20
> > complicated and/or there was no perceived need.=20
>=20
> I'd characterize the reasons a little differently:=20
>  1) The feature was underspecified, there was never enough=20
>    information in the spec to be able to fully implement
>    or interoperate
>  2) Implementation interest was low -- we asked around to see
>    who had implemented this feature and got no positive
>    responses at all.
>=20
> > Eventually it=20
> > was formally deprecated. Is this correct?=20
>=20
> The deprecation isn't final yet, but we are proposing to=20
> deprecate it.
>=20
> > I've also read of=20
> > the "translate" header, which I gather is a=20
> > Microsoft-specific extension? I also gather that this only=20
> > supports a one-to-one mapping between a document and its=20
> > source, i.e. a document has one and only one source?
>=20
> Yes
>=20
> > My case is that I have a server which generates pages from=20
> > multiple sources and keeps track of those sources in such a=20
> > way that it could fairly easily support dav:source. I'd like=20
> > editors to be able to edit the page and select which of the=20
> > source documents to edit. But are there existing clients that=20
> > will actually do that? Or are there other web-dav mechanisms=20
> > that might support my use-case?
>=20
> Not that I know of.  You'd be the first to implement a=20
> protocol feature to expose multiple mappings so nobody
> to interoperate with and no tools to support your feature.
>=20
> If there is sufficient interest from implementors to make
> forward progress on this, I'd recommend a separate draft rather
> than resurrect the unimplemented, underspecified, and untested
> feature in RFC2518.
>=20
> Lisa
>=20
>=20



------=_NextPart_000_0069_01C37EA9.C7A1FA40
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<TITLE>Message</TITLE>

<META content=3D"MSHTML 6.00.2800.1226" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =
size=3D2>It=20
does seem reasonable to use the source property today insofar as it can =
be used=20
for simple cases.&nbsp; It's a good bet that when eventually enough =
implementors=20
need the feature and work on the specification, they can likely reuse =
the same=20
property name.&nbsp;&nbsp; However, the format within the property name =
could be=20
significantly expanded.</FONT></SPAN></DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =
size=3D2>Here=20
are some of my reasons already posted for believing the property is=20
underspecified:</FONT></SPAN></DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =
size=3D2><A=20
href=3D"http://lists.w3.org/Archives/Public/w3c-dist-auth/2002AprJun/0170=
.html">http://lists.w3.org/Archives/Public/w3c-dist-auth/2002AprJun/0170.=
html</A></FONT></SPAN></DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =
size=3D2>Other=20
minor and major reasons why the source property is=20
underspecified:</FONT></SPAN></DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =

size=3D2>&nbsp;- Unlike other places where URLs appear in property =
values, URLs in=20
the source property value are not shown in &lt;href&gt; tags.&nbsp; Was =
this=20
intentional?</FONT></SPAN></DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =

size=3D2>&nbsp;- What do multiple 'link' elements mean=20
semantically?</FONT></SPAN></DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =

size=3D2>&nbsp;- Can the URL in 'dst', in a given source property =
value,&nbsp;be=20
the same URL that the source property appears on?&nbsp; Can it be=20
different?</FONT></SPAN></DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =

size=3D2>&nbsp;- Is this property scalable?&nbsp; Sharemation's WebUI =
runs on=20
hundreds of java files, with hundreds of java class files, a couple =
dozen java=20
libraries, hundreds of text files including resource files, and dozens =
of=20
images.&nbsp; Would the 'source' property for the URL /xythoswfs/webui =
on <A=20
href=3D"http://www.sharemation.com">www.sharemation.com</A> really =
contain over a=20
thousand links plus information on how they tied together?&nbsp; Since =
some of=20
these files can be changed without a recompile, would this property have =
to be=20
dynamically calculated?&nbsp; By what process?&nbsp; To really handle =
this kind=20
of situation, which isn't all that uncommon, the source property would =
have to=20
point to some other authority or way to&nbsp;browse source files.&nbsp; =
Perhaps=20
the source property could point to some directory hierarchy where the =
source=20
files are all stored &amp; there would be more information within the =
properties=20
of resources in that hierarchy.</FONT></SPAN></DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D016181219-19092003><FONT face=3DArial color=3D#0000ff =

size=3D2>Lisa</FONT></SPAN></DIV>
<BLOCKQUOTE=20
style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px =
solid; MARGIN-RIGHT: 0px">
  <DIV></DIV>
  <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr =
align=3Dleft><FONT=20
  face=3DTahoma size=3D2>-----Original Message-----<BR><B>From:</B>=20
  w3c-dist-auth-request@w3.org [mailto:w3c-dist-auth-request@w3.org] =
<B>On=20
  Behalf Of </B>Geoffrey M Clemm<BR><B>Sent:</B> Friday, September 19, =
2003 6:06=20
  AM<BR><B>To:</B> 'WebDAV List (E-mail)'<BR><B>Subject:</B> RE: =
multiple=20
  "source" properties documents<BR><BR></FONT></DIV><BR><FONT =
size=3D2><TT>My=20
  perspective is a bit different. &nbsp;The DAV:source =
property</TT></FONT>=20
  <BR><FONT size=3D2><TT>was designed for exactly the situation that =
Conal=20
  describes.</TT></FONT> <BR><FONT size=3D2><TT>He'd like a generic =
application to=20
  pop up the list of URL's</TT></FONT> <BR><FONT size=3D2><TT>and say =
"these are=20
  the sources". &nbsp;There are no significant</TT></FONT> <BR><FONT=20
  size=3D2><TT>testing issues ... the format of the DAV:source property=20
  is</TT></FONT> <BR><FONT size=3D2><TT>well defined, and all a client =
is expected=20
  to do is to expose</TT></FONT> <BR><FONT size=3D2><TT>the specified =
list of=20
  URL's.</TT></FONT> <BR><BR><FONT size=3D2><TT>So in Conal's case, I'd =
just=20
  expose this feature using the</TT></FONT> <BR><FONT =
size=3D2><TT>DAV:source=20
  property, and you are no worse off that if you</TT></FONT> <BR><FONT=20
  size=3D2><TT>just defined your own custom property, and that if=20
  enough</TT></FONT> <BR><FONT size=3D2><TT>folks do so, the property =
will become=20
  "undeprecated".</TT></FONT> <BR><BR><FONT size=3D2><TT>Note: I am not =
arguing=20
  against deprecating the DAV:source</TT></FONT> <BR><FONT =
size=3D2><TT>feature=20
  ... I don't think the topic is significant enough</TT></FONT> =
<BR><FONT=20
  size=3D2><TT>to merit being re-opened ... I'm just saying that if you=20
  are</TT></FONT> <BR><FONT size=3D2><TT>an implementor and encounter a =
valid use=20
  for the DAV:source</TT></FONT> <BR><FONT size=3D2><TT>property, you =
should go=20
  ahead and use it instead of inventing</TT></FONT> <BR><FONT =
size=3D2><TT>your=20
  own custom property, even if it is deprecated in 2518bis.</TT></FONT>=20
  <BR><BR><FONT size=3D2><TT>Cheers,</TT></FONT> <BR><FONT=20
  size=3D2><TT>Geoff</TT></FONT> <BR><BR><BR><FONT size=3D2><TT>Lisa =
wrote on=20
  09/18/2003 07:41:56 PM:<BR><BR>&gt; <BR>&gt; <BR>&gt; &gt; From what I =
read,=20
  the "source" property was a great idea but <BR>&gt; &gt; no-one ever=20
  implemented it, supposedly because it was too <BR>&gt; &gt; =
complicated and/or=20
  there was no perceived need. <BR>&gt; <BR>&gt; I'd characterize the =
reasons a=20
  little differently: <BR>&gt; &nbsp;1) The feature was underspecified, =
there=20
  was never enough <BR>&gt; &nbsp; &nbsp;information in the spec to be =
able to=20
  fully implement<BR>&gt; &nbsp; &nbsp;or interoperate<BR>&gt; &nbsp;2)=20
  Implementation interest was low -- we asked around to see<BR>&gt; =
&nbsp;=20
  &nbsp;who had implemented this feature and got no positive<BR>&gt; =
&nbsp;=20
  &nbsp;responses at all.<BR>&gt; <BR>&gt; &gt; Eventually it <BR>&gt; =
&gt; was=20
  formally deprecated. Is this correct? <BR>&gt; <BR>&gt; The =
deprecation isn't=20
  final yet, but we are proposing to <BR>&gt; deprecate it.<BR>&gt; =
<BR>&gt;=20
  &gt; I've also read of <BR>&gt; &gt; the "translate" header, which I =
gather is=20
  a <BR>&gt; &gt; Microsoft-specific extension? I also gather that this =
only=20
  <BR>&gt; &gt; supports a one-to-one mapping between a document and its =

  <BR>&gt; &gt; source, i.e. a document has one and only one =
source?<BR>&gt;=20
  <BR>&gt; Yes<BR>&gt; <BR>&gt; &gt; My case is that I have a server =
which=20
  generates pages from <BR>&gt; &gt; multiple sources and keeps track of =
those=20
  sources in such a <BR>&gt; &gt; way that it could fairly easily =
support=20
  dav:source. I'd like <BR>&gt; &gt; editors to be able to edit the page =
and=20
  select which of the <BR>&gt; &gt; source documents to edit. But are =
there=20
  existing clients that <BR>&gt; &gt; will actually do that? Or are =
there other=20
  web-dav mechanisms <BR>&gt; &gt; that might support my =
use-case?<BR>&gt;=20
  <BR>&gt; Not that I know of. &nbsp;You'd be the first to implement a =
<BR>&gt;=20
  protocol feature to expose multiple mappings so nobody<BR>&gt; to =
interoperate=20
  with and no tools to support your feature.<BR>&gt; <BR>&gt; If there =
is=20
  sufficient interest from implementors to make<BR>&gt; forward progress =
on=20
  this, I'd recommend a separate draft rather<BR>&gt; than resurrect the =

  unimplemented, underspecified, and untested<BR>&gt; feature in=20
  RFC2518.<BR>&gt; <BR>&gt; Lisa<BR>&gt; <BR>&gt;=20
<BR></BLOCKQUOTE></TT></FONT></BODY></HTML>

------=_NextPart_000_0069_01C37EA9.C7A1FA40--




From w3c-dist-auth-request@w3.org  Fri Sep 19 20:18:04 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA27240
	for <webdav-archive@lists.ietf.org>; Fri, 19 Sep 2003 20:18:04 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 504E8A0A9E; Fri, 19 Sep 2003 20:17:58 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 63167A0A8F
	for <w3c-dist-auth@frink.w3.org>; Fri, 19 Sep 2003 20:17:55 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id EF57613770; Fri, 19 Sep 2003 20:17:54 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ucsc.edu (cats-mx1.ucsc.edu [128.114.129.36])
	by dr-nick.w3.org (Postfix) with ESMTP id 68078133A2
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 20:17:54 -0400 (EDT)
Received: from Tycho (dhcp-55-196.cse.ucsc.edu [128.114.55.196])
	by ucsc.edu (8.10.1/8.10.1) with SMTP id h8K0G8a04744
	for <w3c-dist-auth@w3.org>; Fri, 19 Sep 2003 17:16:08 -0700 (PDT)
From: "Jim Whitehead" <ejw@cse.ucsc.edu>
To: "WebDAV" <w3c-dist-auth@w3.org>
Date: Fri, 19 Sep 2003 17:17:57 -0700
Message-ID: <AMEPKEBLDJJCCDEJHAMIMEPKJFAA.ejw@cse.ucsc.edu>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_01D7_01C37ED1.F8969A70"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-UCSC-CATS-MailScanner: Found to be clean
Subject: FW: [Moderator Action] WebDAV / Weblogic issue
X-Archived-At: http://www.w3.org/mid/AMEPKEBLDJJCCDEJHAMIMEPKJFAA.ejw@cse.ucsc.edu
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7898
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030920001758.504E8A0A9E@frink.w3.org>
Resent-Date: Fri, 19 Sep 2003 20:17:58 -0400 (EDT)


This is a multi-part message in MIME format.

------=_NextPart_000_01D7_01C37ED1.F8969A70
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Accidentally caught by the spam filter.

- Jim
-----Original Message-----
From: Jonathan Scott [mailto:scotty@uta.edu]
Sent: Friday, September 19, 2003 10:09 AM
To: 'w3c-dist-auth@w3.org'
Subject: [Moderator Action] WebDAV / Weblogic issue


First time poster, so please excuse me.  I have implemented WebDAV and
mod_dav on our Apache 2.0 server.  I have opened up several directories, and
DAV has worked flawlessly.  The problem is when I try to open up the
directory for our WebLogic portal.  There appears to be numerous redirects
and virtual directories and it is playing havoc with DAV.  When I try to
connect, I get a message stating that "The resource requested has moved to
http://www.abc.com/foo/foo/foo.jsp.  Please try connecting to the new
location.  I have tried several ways and paths, but to no avail.
Suggestions are GREATLY appreciated, and the gods of technology will reward
your kindness.  Thanks... :-)

J. D. Scott

------=_NextPart_000_01D7_01C37ED1.F8969A70
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.2800.1170" name=3DGENERATOR></HEAD>
<BODY>
<DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN=20
class=3D225131700-20092003>Accidentally caught by the spam=20
filter.</SPAN></FONT></DIV>
<DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN=20
class=3D225131700-20092003></SPAN></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial color=3D#0000ff size=3D2><SPAN =
class=3D225131700-20092003>-=20
Jim</SPAN></FONT></DIV>
<DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
size=3D2>-----Original Message-----<BR><B>From:</B> Jonathan Scott=20
[mailto:scotty@uta.edu]<BR><B>Sent:</B> Friday, September 19, 2003 10:09 =

AM<BR><B>To:</B> 'w3c-dist-auth@w3.org'<BR><B>Subject:</B> [Moderator =
Action]=20
WebDAV / Weblogic issue<BR><BR></FONT></DIV>
<DIV><SPAN class=3D377425916-19092003><FONT size=3D2>First time poster, =
so please=20
excuse me.&nbsp; I have implemented WebDAV and mod_dav on our Apache 2.0 =

server.&nbsp; I have opened up several directories, and DAV has worked=20
flawlessly.&nbsp; The problem is when I try to open up the directory for =
our=20
WebLogic portal.&nbsp; There appears to be numerous redirects and =
virtual=20
directories and it is playing havoc with DAV.&nbsp; When I try to =
connect, I get=20
a message stating that "The resource requested has moved to <A=20
href=3D"http://www.abc.com/foo/foo/foo.jsp">http://www.abc.com/foo/foo/fo=
o.jsp</A>.&nbsp;=20
Please try connecting to the new location.&nbsp; I have tried several =
ways and=20
paths, but to no avail.&nbsp; Suggestions are GREATLY appreciated, and =
the gods=20
of technology will reward your kindness.&nbsp; Thanks... =
:-)</FONT></SPAN></DIV>
<DIV><SPAN class=3D377425916-19092003><FONT =
size=3D2></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D377425916-19092003><FONT size=3D2>J. D. =
Scott</FONT></SPAN></DIV>
<DIV>&nbsp;</DIV></BODY></HTML>

------=_NextPart_000_01D7_01C37ED1.F8969A70--



From w3c-dist-auth-request@w3.org  Sun Sep 21 05:52:33 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA21533
	for <webdav-archive@lists.ietf.org>; Sun, 21 Sep 2003 05:52:28 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 6EA6BA0C07; Sun, 21 Sep 2003 05:52:21 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 88284A0C0F
	for <w3c-dist-auth@frink.w3.org>; Sun, 21 Sep 2003 05:52:15 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 0E3B5139C4; Sun, 21 Sep 2003 05:50:48 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.s-und-n.de (mail.s-und-n.de [212.8.217.2])
	by dr-nick.w3.org (Postfix) with ESMTP id 9028F139C0
	for <w3c-dist-auth@w3.org>; Sun, 21 Sep 2003 05:50:47 -0400 (EDT)
Received: from notes.sundn.de (ntsrv5.sundn.de [10.10.2.10])
	by mail.s-und-n.de (postfix) with ESMTP id 78DE0B6B85
	for <w3c-dist-auth@w3.org>; Sun, 21 Sep 2003 11:50:36 +0200 (CEST)
Received: from hw0393 ([10.10.20.143])
          by notes.sundn.de (Lotus Domino Release 5.0.8)
          with SMTP id 2003092111503580:1420 ;
          Sun, 21 Sep 2003 11:50:35 +0200 
Message-ID: <02fc01c38026$0f64c240$8f140a0a@hw0393>
From: "Guido Casper" <gcasper@s-und-n.de>
To: <w3c-dist-auth@w3.org>
References: <OFC555C2D1.B14F1A5E-ON85256DA6.00481CCF-85256DA6.00491E8B@us.ibm.com>
Date: Sun, 21 Sep 2003 11:52:24 +0200
MIME-Version: 1.0
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-MIMETrack: Itemize by SMTP Server on PBSN1/Systeme und Netzwerke(Release 5.0.8 |June
 18, 2001) at 21.09.2003 11:50:36,
	Serialize by Router on PBSN1/Systeme und Netzwerke(Release 5.0.8 |June 18, 2001) at
 21.09.2003 11:50:36,
	Serialize complete at 21.09.2003 11:50:36
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset="iso-8859-1"
Subject: Re: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/02fc01c38026$0f64c240$8f140a0a@hw0393
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7899
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030921095221.6EA6BA0C07@frink.w3.org>
Resent-Date: Sun, 21 Sep 2003 05:52:21 -0400 (EDT)
Content-Transfer-Encoding: 7bit


I dare to disagree.
The lock token ALLOWS clients to be written for the behaviour Geoff
describes (2 clients working on behalf of the same user cannot unlock
each others lock).

But does that imply that clients acommodating the use case of wanting to
unlock another client's lock are not compliant? Why would the lock token
then be sent back to the client ever (instead of just a general locking
state)?

Guido


Geoffrey M Clemm <geoffrey.clemm@us.ibm.com> wrote:
> If the client doesn't have permission to do an UNLOCK,
> or if the lock automatically times out
> (the two use cases identified where the server is likely to withhold
> the lock token), the client either cannot do an UNLOCK, or does not
> need to do an UNLOCK.
>
> WRT clients that do not store the lock tokens, but rather try to steal
> any lock token that is allowed by access control, this violates the
> whole point of having lock tokens instead of just a server-side lock
> (i.e. preventing
> two clients working on behalf of the same user from stomping on each
> other),
> and such a client should be fixed, not catered to by servers.
>
> Cheers,
> Geoff
>
> "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003 12:32:20 PM:
>
>> Unfortunately, withholding the locktoken from the client that
>> requested that lock
>> would break UNLOCK for some clients that don't store their own lock
>> tokens. Those clients might show error messages & cause support
>> calls.
>> Thus, as a matter of interoperability, a server would at least have
>> to be careful in providing incomplete information in lockdiscovery.
>>
>> This area is murkier than I had thought.  Should there be a
>> clarification in RFC2518bis? It would obviously be easier to write
>> interoperable clients if all servers had to behave the same in this
>> area.  Is there a de facto
>
>> minimum standard here that we can clarify in the next rev?
>>
>> lisa
>> -----Original Message-----
>> From: w3c-dist-auth-request@w3.org
>> [mailto:w3c-dist-auth-request@w3.org]
>
>> On Behalf Of Geoffrey M Clemm
>> Sent: Thursday, September 18, 2003 5:17 AM
>> To: w3c-dist-auth@w3.org
>> Subject: RE: ACL and lockdiscovery
>
>>
>> That is not correct.  RFC-2518 explicitly states in
>> section 13.8 (where the DAV:lockdiscovery property is defined):
>>
>> "The server is free to withhold any or all of this information
>> if the requesting principal does not have sufficient access rights
>> to see the requested data."
>>
>> In particular, if the client does not have sufficient access
>> rights to UNLOCK the resource, a server could very reasonably
>> choose to hide the lock-token information.
>>
>> In addition, a server for which locks have a reasonably
>> short maximum expiration may chose to never expose the lock tokens
>> (i.e. nobody has sufficient access rights to see the lock tokens).
>>
>> Cheers,
>> Geoff
>>
>> w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
>>
>>>
>>> I'd also point out that the lockdiscovery property MUST contain
>>> all the lock tokens, regardless of access control settings.  This
>>> is not considered a security leak, because authorization is also
>>> needed to use a lock token.  So this is the server logic to apply
>>> whenever the client provides a lock token:
>>>
>>> Is this the same authorization context that took out the lock?
>>>   Yes {
>>>    Allow the operation normally, provided the operation is
>>>    allowed, and provided the lock token is correct and all
>>>    required lock tokens are provided, etc.
>>>   } No {
>>>    Is this an UNLOCK operation, with an authorization that
>>>    includes permission to delete others' locks?
>>>    Yes {
>>>       perform UNLOCK
>>>    } No {
>>>       Fail request
>>>    }
>>>   }
>>>
>>> Lisa
>>>
>>>> -----Original Message-----
>>>> From: w3c-dist-auth-request@w3.org
>>>> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
>>>> Sent: Wednesday, September 17, 2003 11:17 AM
>>>> To: 'Horst Liermann'; w3c-dist-auth@w3.org
>>>> Subject: RE: ACL and lockdiscovery
>>>>
>>>>
>>>>
>>>> The ACL spec hasn't defined a privilege specifically to
>>>> control read access to the lockdiscovery property, or even a
>>>> privilege to control access to all the privileges in total.
>>>> An individual server implementation could provide such a
>>>> privilege and aggregate it under <dav:read>, but this isn't
>>>> required.
>>>>
>>>> --Eric
>>>>
>>>>> -----Original Message-----
>>>>> From: w3c-dist-auth-request@w3.org
>>>>> [mailto:w3c-dist-auth-request@w3.org]
>>>>> On Behalf Of Horst Liermann
>>>>> Sent: Wednesday, September 17, 2003 10:08 AM
>>>>> To: 'w3c-dist-auth@w3.org'
>>>>>
>>>>>
>>>>> Hi all,
>>>>>
>>>>> some questions about lockdiscovery and ACL's
>>>>>
>>>>> Suppose, you have a server with WebDAV ( including lock) and it
>>>>> support's ACL. What is the behavior for lockdiscovery, can
>>>> I see all
>>>>> lock token or am I only allowed to see the tokens where I
>>>> am the owner
>>>>> of the lock ? As far as I understand, lockdiscovery reports
>>>> all locks.
>>>>> Is this a security leak ?
>>>>>
>>>>> Best Regards
>>>>>    Horst



From w3c-dist-auth-request@w3.org  Mon Sep 22 11:31:31 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA20526
	for <webdav-archive@lists.ietf.org>; Mon, 22 Sep 2003 11:31:21 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 6BDF6A0506; Mon, 22 Sep 2003 11:30:23 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id C988FA06E4
	for <w3c-dist-auth@frink.w3.org>; Mon, 22 Sep 2003 11:30:20 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id B300A13A85; Mon, 22 Sep 2003 11:30:20 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from e5.ny.us.ibm.com (e5.ny.us.ibm.com [32.97.182.105])
	by dr-nick.w3.org (Postfix) with ESMTP id 83C7413A73
	for <w3c-dist-auth@w3.org>; Mon, 22 Sep 2003 11:30:20 -0400 (EDT)
Received: from northrelay04.pok.ibm.com (northrelay04.pok.ibm.com [9.56.224.206])
	by e5.ny.us.ibm.com (8.12.10/8.12.2) with ESMTP id h8MFUKEd422396
	for <w3c-dist-auth@w3.org>; Mon, 22 Sep 2003 11:30:20 -0400
Received: from d01ml261.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216])
	by northrelay04.pok.ibm.com (8.12.9/NCO/VER6.6) with ESMTP id h8MFUIqb215376
	for <w3c-dist-auth@w3.org>; Mon, 22 Sep 2003 11:30:19 -0400
In-Reply-To: <02fc01c38026$0f64c240$8f140a0a@hw0393>
To: w3c-dist-auth@w3.org
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 6.0.2CF1 June 9, 2003
Message-ID: <OFCA0036F9.A3F38A9D-ON85256DA9.0053FB33-85256DA9.0055300E@us.ibm.com>
From: Geoffrey M Clemm <geoffrey.clemm@us.ibm.com>
Date: Mon, 22 Sep 2003 11:30:28 -0400
X-MIMETrack: Serialize by Router on D01ML261/01/M/IBM(Release 6.0.2CF2|July 23, 2003) at
 09/22/2003 11:30:19,
	Serialize complete at 09/22/2003 11:30:19
Content-Type: text/plain; charset="US-ASCII"
Subject: Re: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/OFCA0036F9.A3F38A9D-ON85256DA9.0053FB33-85256DA9.0055300E@us.ibm.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7900
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030922153023.6BDF6A0506@frink.w3.org>
Resent-Date: Mon, 22 Sep 2003 11:30:23 -0400 (EDT)


I should have been clearer.  By "steal a lock token", I meant
"do an update operation with a lock token that was issued to
another client", not "unlock a lock issued to another client".

Any appropriately authorized client can UNLOCK a locked resource.
There is no problem with that (and it doesn't matter whether or
not it is a client running on behalf of the same user that took
out the lock).

The problem is when a client performs an update by using a lock
token issued to another client (where it discovered
the lock token using lock discovery).  That is the behavior that
violates the whole point of having a lock token.

For the question of why a lock token is ever sent back to the client,
(I assume you mean "in lock discovery" ... it of course has to be
sent back to the client creating the lock).  The reason is that there
can be several locks on a resource, and the client may only want to
UNLOCK a particular lock.

Cheers,
Geoff

Guido wrote on 09/21/2003 05:52:24 AM:

> I dare to disagree.
> The lock token ALLOWS clients to be written for the behaviour Geoff
> describes (2 clients working on behalf of the same user cannot unlock
> each others lock).
> 
> But does that imply that clients acommodating the use case of wanting to
> unlock another client's lock are not compliant? Why would the lock token
> then be sent back to the client ever (instead of just a general locking
> state)?
> 
> Guido
> 
> 
> Geoffrey M Clemm <geoffrey.clemm@us.ibm.com> wrote:
> > If the client doesn't have permission to do an UNLOCK,
> > or if the lock automatically times out
> > (the two use cases identified where the server is likely to withhold
> > the lock token), the client either cannot do an UNLOCK, or does not
> > need to do an UNLOCK.
> >
> > WRT clients that do not store the lock tokens, but rather try to steal
> > any lock token that is allowed by access control, this violates the
> > whole point of having lock tokens instead of just a server-side lock
> > (i.e. preventing
> > two clients working on behalf of the same user from stomping on each
> > other),
> > and such a client should be fixed, not catered to by servers.
> >
> > Cheers,
> > Geoff
> >
> > "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003 12:32:20 PM:
> >
> >> Unfortunately, withholding the locktoken from the client that
> >> requested that lock
> >> would break UNLOCK for some clients that don't store their own lock
> >> tokens. Those clients might show error messages & cause support
> >> calls.
> >> Thus, as a matter of interoperability, a server would at least have
> >> to be careful in providing incomplete information in lockdiscovery.
> >>
> >> This area is murkier than I had thought.  Should there be a
> >> clarification in RFC2518bis? It would obviously be easier to write
> >> interoperable clients if all servers had to behave the same in this
> >> area.  Is there a de facto
> >
> >> minimum standard here that we can clarify in the next rev?
> >>
> >> lisa
> >> -----Original Message-----
> >> From: w3c-dist-auth-request@w3.org
> >> [mailto:w3c-dist-auth-request@w3.org]
> >
> >> On Behalf Of Geoffrey M Clemm
> >> Sent: Thursday, September 18, 2003 5:17 AM
> >> To: w3c-dist-auth@w3.org
> >> Subject: RE: ACL and lockdiscovery
> >
> >>
> >> That is not correct.  RFC-2518 explicitly states in
> >> section 13.8 (where the DAV:lockdiscovery property is defined):
> >>
> >> "The server is free to withhold any or all of this information
> >> if the requesting principal does not have sufficient access rights
> >> to see the requested data."
> >>
> >> In particular, if the client does not have sufficient access
> >> rights to UNLOCK the resource, a server could very reasonably
> >> choose to hide the lock-token information.
> >>
> >> In addition, a server for which locks have a reasonably
> >> short maximum expiration may chose to never expose the lock tokens
> >> (i.e. nobody has sufficient access rights to see the lock tokens).
> >>
> >> Cheers,
> >> Geoff
> >>
> >> w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
> >>
> >>>
> >>> I'd also point out that the lockdiscovery property MUST contain
> >>> all the lock tokens, regardless of access control settings.  This
> >>> is not considered a security leak, because authorization is also
> >>> needed to use a lock token.  So this is the server logic to apply
> >>> whenever the client provides a lock token:
> >>>
> >>> Is this the same authorization context that took out the lock?
> >>>   Yes {
> >>>    Allow the operation normally, provided the operation is
> >>>    allowed, and provided the lock token is correct and all
> >>>    required lock tokens are provided, etc.
> >>>   } No {
> >>>    Is this an UNLOCK operation, with an authorization that
> >>>    includes permission to delete others' locks?
> >>>    Yes {
> >>>       perform UNLOCK
> >>>    } No {
> >>>       Fail request
> >>>    }
> >>>   }
> >>>
> >>> Lisa
> >>>
> >>>> -----Original Message-----
> >>>> From: w3c-dist-auth-request@w3.org
> >>>> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> >>>> Sent: Wednesday, September 17, 2003 11:17 AM
> >>>> To: 'Horst Liermann'; w3c-dist-auth@w3.org
> >>>> Subject: RE: ACL and lockdiscovery
> >>>>
> >>>>
> >>>>
> >>>> The ACL spec hasn't defined a privilege specifically to
> >>>> control read access to the lockdiscovery property, or even a
> >>>> privilege to control access to all the privileges in total.
> >>>> An individual server implementation could provide such a
> >>>> privilege and aggregate it under <dav:read>, but this isn't
> >>>> required.
> >>>>
> >>>> --Eric
> >>>>
> >>>>> -----Original Message-----
> >>>>> From: w3c-dist-auth-request@w3.org
> >>>>> [mailto:w3c-dist-auth-request@w3.org]
> >>>>> On Behalf Of Horst Liermann
> >>>>> Sent: Wednesday, September 17, 2003 10:08 AM
> >>>>> To: 'w3c-dist-auth@w3.org'
> >>>>>
> >>>>>
> >>>>> Hi all,
> >>>>>
> >>>>> some questions about lockdiscovery and ACL's
> >>>>>
> >>>>> Suppose, you have a server with WebDAV ( including lock) and it
> >>>>> support's ACL. What is the behavior for lockdiscovery, can
> >>>> I see all
> >>>>> lock token or am I only allowed to see the tokens where I
> >>>> am the owner
> >>>>> of the lock ? As far as I understand, lockdiscovery reports
> >>>> all locks.
> >>>>> Is this a security leak ?
> >>>>>
> >>>>> Best Regards
> >>>>>    Horst
> 



From w3c-dist-auth-request@w3.org  Mon Sep 22 12:42:37 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA24319
	for <webdav-archive@lists.ietf.org>; Mon, 22 Sep 2003 12:42:37 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 26042A0819; Mon, 22 Sep 2003 12:42:24 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 20BF8A0819
	for <w3c-dist-auth@frink.w3.org>; Mon, 22 Sep 2003 12:42:16 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 9645913AB2; Mon, 22 Sep 2003 12:40:28 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id 4903313AB1
	for <w3c-dist-auth@w3.org>; Mon, 22 Sep 2003 12:40:28 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 1A1Tjf-0003UX-00; Mon, 22 Sep 2003 16:40:27 +0000
Received: from [192.168.1.151] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 1A1Tjf-0003UM-00; Mon, 22 Sep 2003 16:40:27 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: "'Geoffrey M Clemm'" <geoffrey.clemm@us.ibm.com>, <w3c-dist-auth@w3.org>
Date: Mon, 22 Sep 2003 09:40:27 -0700
Message-ID: <000a01c38128$3ae8b4f0$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
In-Reply-To: <OFCA0036F9.A3F38A9D-ON85256DA9.0053FB33-85256DA9.0055300E@us.ibm.com>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
Old-X-Envelope-To: geoffrey.clemm@us.ibm.com,
 w3c-dist-auth@w3.org
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/000a01c38128$3ae8b4f0$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7901
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030922164224.26042A0819@frink.w3.org>
Resent-Date: Mon, 22 Sep 2003 12:42:24 -0400 (EDT)
Content-Transfer-Encoding: 7bit


> 
> For the question of why a lock token is ever sent back to the 
> client, (I assume you mean "in lock discovery" ... it of 
> course has to be sent back to the client creating the lock).  
> The reason is that there can be several locks on a resource, 
> and the client may only want to UNLOCK a particular lock.

Yes, this is important, and I'll add a bit more detail for client
considerations:

1. The client MUST remember the lock token and/or put some 
   self-identifying information in the owner field of the lock
   That's because if I'm running two WebDAV clients, possibly
   either on the same computer or two different computers but 
   both logged in as me, those two clients need to use only their
   own locks.  It would mess things up if my synchronization client
   used the lock token taken out by my authoring client and 
   overwrote all my new changes.  It's not enough to be the user
   that owns the lock, the client must also be the same client (or
   coordinating with the same client) that took out the lock.

2. If the server doesn't provide the lock token in the lock discovery
   property value, how are client supposed to know *which* locks
   are currently on the resource?   The lock token is currently the
   only way to identify a lock.  This information can help the client
   figure out what's going on -- e.g. to be confident that the lock
   that the client requested an hour ago is still valid.

Lisa

> 
> Cheers,
> Geoff
> 
> Guido wrote on 09/21/2003 05:52:24 AM:
> 
> > I dare to disagree.
> > The lock token ALLOWS clients to be written for the behaviour Geoff 
> > describes (2 clients working on behalf of the same user 
> cannot unlock 
> > each others lock).
> > 
> > But does that imply that clients acommodating the use case 
> of wanting 
> > to unlock another client's lock are not compliant? Why 
> would the lock 
> > token then be sent back to the client ever (instead of just 
> a general 
> > locking state)?
> > 
> > Guido
> > 
> > 
> > Geoffrey M Clemm <geoffrey.clemm@us.ibm.com> wrote:
> > > If the client doesn't have permission to do an UNLOCK,
> > > or if the lock automatically times out
> > > (the two use cases identified where the server is likely 
> to withhold 
> > > the lock token), the client either cannot do an UNLOCK, 
> or does not 
> > > need to do an UNLOCK.
> > >
> > > WRT clients that do not store the lock tokens, but rather try to 
> > > steal any lock token that is allowed by access control, this 
> > > violates the whole point of having lock tokens instead of just a 
> > > server-side lock (i.e. preventing two clients working on 
> behalf of 
> > > the same user from stomping on each other),
> > > and such a client should be fixed, not catered to by servers.
> > >
> > > Cheers,
> > > Geoff
> > >
> > > "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003 
> 12:32:20 PM:
> > >
> > >> Unfortunately, withholding the locktoken from the client that 
> > >> requested that lock would break UNLOCK for some clients 
> that don't 
> > >> store their own lock tokens. Those clients might show error 
> > >> messages & cause support calls.
> > >> Thus, as a matter of interoperability, a server would at 
> least have
> > >> to be careful in providing incomplete information in 
> lockdiscovery.
> > >>
> > >> This area is murkier than I had thought.  Should there be a 
> > >> clarification in RFC2518bis? It would obviously be 
> easier to write 
> > >> interoperable clients if all servers had to behave the 
> same in this 
> > >> area.  Is there a de facto
> > >
> > >> minimum standard here that we can clarify in the next rev?
> > >>
> > >> lisa
> > >> -----Original Message-----
> > >> From: w3c-dist-auth-request@w3.org 
> > >> [mailto:w3c-dist-auth-request@w3.org]
> > >
> > >> On Behalf Of Geoffrey M Clemm
> > >> Sent: Thursday, September 18, 2003 5:17 AM
> > >> To: w3c-dist-auth@w3.org
> > >> Subject: RE: ACL and lockdiscovery
> > >
> > >>
> > >> That is not correct.  RFC-2518 explicitly states in section 13.8 
> > >> (where the DAV:lockdiscovery property is defined):
> > >>
> > >> "The server is free to withhold any or all of this 
> information if 
> > >> the requesting principal does not have sufficient access 
> rights to 
> > >> see the requested data."
> > >>
> > >> In particular, if the client does not have sufficient 
> access rights 
> > >> to UNLOCK the resource, a server could very reasonably choose to 
> > >> hide the lock-token information.
> > >>
> > >> In addition, a server for which locks have a reasonably short 
> > >> maximum expiration may chose to never expose the lock 
> tokens (i.e. 
> > >> nobody has sufficient access rights to see the lock tokens).
> > >>
> > >> Cheers,
> > >> Geoff
> > >>
> > >> w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
> > >>
> > >>>
> > >>> I'd also point out that the lockdiscovery property MUST contain 
> > >>> all the lock tokens, regardless of access control 
> settings.  This 
> > >>> is not considered a security leak, because 
> authorization is also 
> > >>> needed to use a lock token.  So this is the server 
> logic to apply 
> > >>> whenever the client provides a lock token:
> > >>>
> > >>> Is this the same authorization context that took out the lock?
> > >>>   Yes {
> > >>>    Allow the operation normally, provided the operation is
> > >>>    allowed, and provided the lock token is correct and all
> > >>>    required lock tokens are provided, etc.
> > >>>   } No {
> > >>>    Is this an UNLOCK operation, with an authorization that
> > >>>    includes permission to delete others' locks?
> > >>>    Yes {
> > >>>       perform UNLOCK
> > >>>    } No {
> > >>>       Fail request
> > >>>    }
> > >>>   }
> > >>>
> > >>> Lisa
> > >>>
> > >>>> -----Original Message-----
> > >>>> From: w3c-dist-auth-request@w3.org 
> > >>>> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> > >>>> Sent: Wednesday, September 17, 2003 11:17 AM
> > >>>> To: 'Horst Liermann'; w3c-dist-auth@w3.org
> > >>>> Subject: RE: ACL and lockdiscovery
> > >>>>
> > >>>>
> > >>>>
> > >>>> The ACL spec hasn't defined a privilege specifically 
> to control 
> > >>>> read access to the lockdiscovery property, or even a 
> privilege to 
> > >>>> control access to all the privileges in total. An individual 
> > >>>> server implementation could provide such a privilege and 
> > >>>> aggregate it under <dav:read>, but this isn't required.
> > >>>>
> > >>>> --Eric
> > >>>>
> > >>>>> -----Original Message-----
> > >>>>> From: w3c-dist-auth-request@w3.org 
> > >>>>> [mailto:w3c-dist-auth-request@w3.org]
> > >>>>> On Behalf Of Horst Liermann
> > >>>>> Sent: Wednesday, September 17, 2003 10:08 AM
> > >>>>> To: 'w3c-dist-auth@w3.org'
> > >>>>>
> > >>>>>
> > >>>>> Hi all,
> > >>>>>
> > >>>>> some questions about lockdiscovery and ACL's
> > >>>>>
> > >>>>> Suppose, you have a server with WebDAV ( including 
> lock) and it 
> > >>>>> support's ACL. What is the behavior for lockdiscovery, can
> > >>>> I see all
> > >>>>> lock token or am I only allowed to see the tokens where I
> > >>>> am the owner
> > >>>>> of the lock ? As far as I understand, lockdiscovery reports
> > >>>> all locks.
> > >>>>> Is this a security leak ?
> > >>>>>
> > >>>>> Best Regards
> > >>>>>    Horst
> > 
> 
> 




From w3c-dist-auth-request@w3.org  Mon Sep 22 14:14:12 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA28342
	for <webdav-archive@lists.ietf.org>; Mon, 22 Sep 2003 14:14:01 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 146AAA079E; Mon, 22 Sep 2003 14:13:52 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 77753A079E
	for <w3c-dist-auth@frink.w3.org>; Mon, 22 Sep 2003 14:13:47 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 15BF213AA2; Mon, 22 Sep 2003 14:13:47 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.s-und-n.de (mail.s-und-n.de [212.8.217.2])
	by dr-nick.w3.org (Postfix) with ESMTP id 783FF13A92
	for <w3c-dist-auth@w3.org>; Mon, 22 Sep 2003 14:13:46 -0400 (EDT)
Received: from notes.sundn.de (ntsrv5.sundn.de [10.10.2.10])
	by mail.s-und-n.de (postfix) with ESMTP id 1B5ECB779B
	for <w3c-dist-auth@w3.org>; Mon, 22 Sep 2003 20:13:45 +0200 (CEST)
Received: from hw0393 ([10.10.20.143])
          by notes.sundn.de (Lotus Domino Release 5.0.8)
          with SMTP id 2003092220134275:5296 ;
          Mon, 22 Sep 2003 20:13:42 +0200 
Message-ID: <00de01c38135$83cdfab0$8f140a0a@hw0393>
From: "Guido Casper" <gcasper@s-und-n.de>
To: <w3c-dist-auth@w3.org>
References: <OFCA0036F9.A3F38A9D-ON85256DA9.0053FB33-85256DA9.0055300E@us.ibm.com>
Date: Mon, 22 Sep 2003 20:15:32 +0200
MIME-Version: 1.0
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
X-MIMETrack: Itemize by SMTP Server on PBSN1/Systeme und Netzwerke(Release 5.0.8 |June
 18, 2001) at 22.09.2003 20:13:43,
	Serialize by Router on PBSN1/Systeme und Netzwerke(Release 5.0.8 |June 18, 2001) at
 22.09.2003 20:13:45,
	Serialize complete at 22.09.2003 20:13:45
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset="iso-8859-1"
Subject: Re: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/00de01c38135$83cdfab0$8f140a0a@hw0393
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7902
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030922181352.146AAA079E@frink.w3.org>
Resent-Date: Mon, 22 Sep 2003 14:13:52 -0400 (EDT)
Content-Transfer-Encoding: 7bit


OK, thanks for clarification to Geoff and Lisa.

Guido

Geoffrey M Clemm <geoffrey.clemm@us.ibm.com> wrote:
> I should have been clearer.  By "steal a lock token", I meant
> "do an update operation with a lock token that was issued to
> another client", not "unlock a lock issued to another client".
>
> Any appropriately authorized client can UNLOCK a locked resource.
> There is no problem with that (and it doesn't matter whether or
> not it is a client running on behalf of the same user that took
> out the lock).
>
> The problem is when a client performs an update by using a lock
> token issued to another client (where it discovered
> the lock token using lock discovery).  That is the behavior that
> violates the whole point of having a lock token.
>
> For the question of why a lock token is ever sent back to the client,
> (I assume you mean "in lock discovery" ... it of course has to be
> sent back to the client creating the lock).  The reason is that there
> can be several locks on a resource, and the client may only want to
> UNLOCK a particular lock.
>
> Cheers,
> Geoff
>
> Guido wrote on 09/21/2003 05:52:24 AM:
>
>> I dare to disagree.
>> The lock token ALLOWS clients to be written for the behaviour Geoff
>> describes (2 clients working on behalf of the same user cannot unlock
>> each others lock).
>>
>> But does that imply that clients acommodating the use case of
>> wanting to unlock another client's lock are not compliant? Why would
>> the lock token then be sent back to the client ever (instead of just
>> a general locking state)?
>>
>> Guido
>>
>>
>> Geoffrey M Clemm <geoffrey.clemm@us.ibm.com> wrote:
>>> If the client doesn't have permission to do an UNLOCK,
>>> or if the lock automatically times out
>>> (the two use cases identified where the server is likely to withhold
>>> the lock token), the client either cannot do an UNLOCK, or does not
>>> need to do an UNLOCK.
>>>
>>> WRT clients that do not store the lock tokens, but rather try to
>>> steal any lock token that is allowed by access control, this
>>> violates the whole point of having lock tokens instead of just a
>>> server-side lock (i.e. preventing
>>> two clients working on behalf of the same user from stomping on each
>>> other),
>>> and such a client should be fixed, not catered to by servers.
>>>
>>> Cheers,
>>> Geoff
>>>
>>> "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003 12:32:20 PM:
>>>
>>>> Unfortunately, withholding the locktoken from the client that
>>>> requested that lock
>>>> would break UNLOCK for some clients that don't store their own lock
>>>> tokens. Those clients might show error messages & cause support
>>>> calls.
>>>> Thus, as a matter of interoperability, a server would at least have
>>>> to be careful in providing incomplete information in lockdiscovery.
>>>>
>>>> This area is murkier than I had thought.  Should there be a
>>>> clarification in RFC2518bis? It would obviously be easier to write
>>>> interoperable clients if all servers had to behave the same in this
>>>> area.  Is there a de facto
>>>
>>>> minimum standard here that we can clarify in the next rev?
>>>>
>>>> lisa
>>>> -----Original Message-----
>>>> From: w3c-dist-auth-request@w3.org
>>>> [mailto:w3c-dist-auth-request@w3.org]
>>>
>>>> On Behalf Of Geoffrey M Clemm
>>>> Sent: Thursday, September 18, 2003 5:17 AM
>>>> To: w3c-dist-auth@w3.org
>>>> Subject: RE: ACL and lockdiscovery
>>>
>>>>
>>>> That is not correct.  RFC-2518 explicitly states in
>>>> section 13.8 (where the DAV:lockdiscovery property is defined):
>>>>
>>>> "The server is free to withhold any or all of this information
>>>> if the requesting principal does not have sufficient access rights
>>>> to see the requested data."
>>>>
>>>> In particular, if the client does not have sufficient access
>>>> rights to UNLOCK the resource, a server could very reasonably
>>>> choose to hide the lock-token information.
>>>>
>>>> In addition, a server for which locks have a reasonably
>>>> short maximum expiration may chose to never expose the lock tokens
>>>> (i.e. nobody has sufficient access rights to see the lock tokens).
>>>>
>>>> Cheers,
>>>> Geoff
>>>>
>>>> w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
>>>>
>>>>>
>>>>> I'd also point out that the lockdiscovery property MUST contain
>>>>> all the lock tokens, regardless of access control settings.  This
>>>>> is not considered a security leak, because authorization is also
>>>>> needed to use a lock token.  So this is the server logic to apply
>>>>> whenever the client provides a lock token:
>>>>>
>>>>> Is this the same authorization context that took out the lock?
>>>>>   Yes {
>>>>>    Allow the operation normally, provided the operation is
>>>>>    allowed, and provided the lock token is correct and all
>>>>>    required lock tokens are provided, etc.
>>>>>   } No {
>>>>>    Is this an UNLOCK operation, with an authorization that
>>>>>    includes permission to delete others' locks?
>>>>>    Yes {
>>>>>       perform UNLOCK
>>>>>    } No {
>>>>>       Fail request
>>>>>    }
>>>>>   }
>>>>>
>>>>> Lisa
>>>>>
>>>>>> -----Original Message-----
>>>>>> From: w3c-dist-auth-request@w3.org
>>>>>> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
>>>>>> Sent: Wednesday, September 17, 2003 11:17 AM
>>>>>> To: 'Horst Liermann'; w3c-dist-auth@w3.org
>>>>>> Subject: RE: ACL and lockdiscovery
>>>>>>
>>>>>>
>>>>>>
>>>>>> The ACL spec hasn't defined a privilege specifically to
>>>>>> control read access to the lockdiscovery property, or even a
>>>>>> privilege to control access to all the privileges in total.
>>>>>> An individual server implementation could provide such a
>>>>>> privilege and aggregate it under <dav:read>, but this isn't
>>>>>> required.
>>>>>>
>>>>>> --Eric
>>>>>>
>>>>>>> -----Original Message-----
>>>>>>> From: w3c-dist-auth-request@w3.org
>>>>>>> [mailto:w3c-dist-auth-request@w3.org]
>>>>>>> On Behalf Of Horst Liermann
>>>>>>> Sent: Wednesday, September 17, 2003 10:08 AM
>>>>>>> To: 'w3c-dist-auth@w3.org'
>>>>>>>
>>>>>>>
>>>>>>> Hi all,
>>>>>>>
>>>>>>> some questions about lockdiscovery and ACL's
>>>>>>>
>>>>>>> Suppose, you have a server with WebDAV ( including lock) and it
>>>>>>> support's ACL. What is the behavior for lockdiscovery, can
>>>>>> I see all
>>>>>>> lock token or am I only allowed to see the tokens where I
>>>>>> am the owner
>>>>>>> of the lock ? As far as I understand, lockdiscovery reports
>>>>>> all locks.
>>>>>>> Is this a security leak ?
>>>>>>>
>>>>>>> Best Regards
>>>>>>>    Horst



From w3c-dist-auth-request@w3.org  Mon Sep 22 16:02:35 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA07139
	for <webdav-archive@lists.ietf.org>; Mon, 22 Sep 2003 16:02:33 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 43BFAA051D; Mon, 22 Sep 2003 16:02:12 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id C77FBA051D
	for <w3c-dist-auth@frink.w3.org>; Mon, 22 Sep 2003 16:02:09 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 9E4BE13ABF; Mon, 22 Sep 2003 15:59:20 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.state.mn.us (state.mn.us [156.99.125.109])
	by dr-nick.w3.org (Postfix) with SMTP id 5A55A13AAF
	for <w3c-dist-auth@w3.org>; Mon, 22 Sep 2003 15:59:20 -0400 (EDT)
Received: from cfb-server1.auditor.leg.state.mn.us (cfb-server1.auditor.leg.state.mn.us [156.99.93.230]) by mail.state.mn.us with ESMTP for w3c-dist-auth@w3.org; Mon, 22 Sep 2003 14:59:20 -0500
Received: from CFB-SERVER1/SpoolDir by cfb-server1.auditor.leg.state.mn.us (Mercury 1.48);
    22 Sep 03 15:04:04 GMT-600
Received: from SpoolDir by CFB-SERVER1 (Mercury 1.48); 22 Sep 03 15:03:41 GMT-600
From: "Xiaowei Cao" <Xiaowei.Cao@state.mn.us>
Organization: Campaign Finance Board
To: w3c-dist-auth@w3.org
Date: Mon, 22 Sep 2003 15:03:35 -0500
MIME-Version: 1.0
Message-Id: <3F6F0F47.4657.5FD7F1@localhost>
X-Confirm-Reading-To: "Xiaowei Cao" <xcao@cfb-server1.auditor.leg.state.mn.us>
Priority: normal
X-mailer: Pegasus Mail for Windows (v4.11)
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Content-description: Mail message body
Subject: webdav confiuration
X-Archived-At: http://www.w3.org/mid/3F6F0F47.4657.5FD7F1@localhost
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7903
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030922200212.43BFAA051D@frink.w3.org>
Resent-Date: Mon, 22 Sep 2003 16:02:12 -0400 (EDT)
Content-Transfer-Encoding: 7BIT


I'm new to webdav

We are using windows 2003 standard edition and IIS6.0.
The webserver is a standalone server.
Our website is a public site that everyone can access.

I'm experimenting to setup WebDav for our developer to transfer 
webpages from a windows xp to the server.
Both server and client the webdav are enabled successfully.

I setup a virtual directory like "test"

I setup  NTFS permission to IUSR_servername account to only deny 
write. Because I don't want anyone to write to our directory.

In directory Test web permission, I set to read, write, directory 
browse, on directory security tab I set to allow anonymous Access. 

Now when I start using webdav in the windows Xp, by opening IE6.0 
browser, like http://servername/test/index.htm
I can see the page. If I open http://servername/test as a web folder, 
I can see the files in the folder but I cannot copy files to it.

This is fine to anonymous users. but how can I let the developer to 
copy files to that directory? 

In other words, I want only developers to write to that directory, 
and also I want all anonymous users to see the webpages. How can I 
configure the security issues related to this?


Thanks 



From w3c-dist-auth-request@w3.org  Mon Sep 22 18:24:49 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA15289
	for <webdav-archive@lists.ietf.org>; Mon, 22 Sep 2003 18:24:49 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 61C66A07CF; Mon, 22 Sep 2003 18:24:57 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id A3881A07E6
	for <w3c-dist-auth@frink.w3.org>; Mon, 22 Sep 2003 18:24:54 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 31882136D0; Mon, 22 Sep 2003 18:24:54 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ucsc.edu (cats-mx2.ucsc.edu [128.114.129.35])
	by dr-nick.w3.org (Postfix) with ESMTP id 8A9C5133BB
	for <w3c-dist-auth@w3.org>; Mon, 22 Sep 2003 18:24:53 -0400 (EDT)
Received: from Tycho (dhcp-55-196.cse.ucsc.edu [128.114.55.196])
	by ucsc.edu (8.10.1/8.10.1) with SMTP id h8MMN2Q10427
	for <w3c-dist-auth@w3.org>; Mon, 22 Sep 2003 15:23:02 -0700 (PDT)
From: "Jim Whitehead" <ejw@cse.ucsc.edu>
To: "WebDAV" <w3c-dist-auth@w3.org>
Date: Mon, 22 Sep 2003 15:24:19 -0700
Message-ID: <AMEPKEBLDJJCCDEJHAMIEELJJGAA.ejw@cse.ucsc.edu>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
Importance: Normal
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
X-UCSC-CATS-MailScanner: Found to be clean
Subject: FW:  Not able to save changes made to a doc file in WebDAV server !!
X-Archived-At: http://www.w3.org/mid/AMEPKEBLDJJCCDEJHAMIEELJJGAA.ejw@cse.ucsc.edu
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7904
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030922222457.61C66A07CF@frink.w3.org>
Resent-Date: Mon, 22 Sep 2003 18:24:57 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Accidentally caught by the spam filter.

- Jim

-----Original Message-----
From: Ram Prasadh [mailto:rprasadh@zaplet.com]
Sent: Monday, September 22, 2003 11:52 AM
To: w3c-dist-auth@w3.org
Subject: [Moderator Action] Not able to save changes made to a doc file
in WebDAV server !!




Hi,
	I am using WebDAV for enabling file versioning in my application. I am able
to launch the WebDAV client, it MS-Word., when I try to open the doc file.
Normally, I am able to save the changes to the server using webDAV. But if
the filename has an & ie "A & B.doc" then it opens the file in WebDAV client
with proper content, but it pops up a Save As dialog box when I try to save
any changes made to the file. Basically I stream the content and the
content-type from the server.

thanks,
prasadh



From w3c-dist-auth-request@w3.org  Tue Sep 23 16:16:31 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA04880
	for <webdav-archive@lists.ietf.org>; Tue, 23 Sep 2003 16:16:31 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 4C5CAA0565; Tue, 23 Sep 2003 16:16:38 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id AD8A9A085A
	for <w3c-dist-auth@frink.w3.org>; Tue, 23 Sep 2003 16:16:35 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 45652133CC; Tue, 23 Sep 2003 16:16:35 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3c.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id 016D113369
	for <w3c-dist-auth@w3c.org>; Tue, 23 Sep 2003 16:16:35 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 1A1taK-00085h-00; Tue, 23 Sep 2003 20:16:32 +0000
Received: from [192.168.1.151] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 1A1taJ-00085P-00; Tue, 23 Sep 2003 20:16:32 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: <acl@webdav.org>, "Webdav WG" <w3c-dist-auth@w3c.org>
Cc: "Ted Hardie" <hardie@qualcomm.com>, "'Jim Whitehead'" <ejw@cse.ucsc.edu>
Date: Tue, 23 Sep 2003 13:16:33 -0700
Message-ID: <01f601c3820f$95724480$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="utf-8"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
Old-X-Envelope-To: acl@webdav.org,
 ejw@cse.ucsc.edu,
 hardie@qualcomm.com,
 w3c-dist-auth@w3c.org
Subject: ANNOUNCE: ACL draft to WebDAV working group last call
X-Archived-At: http://www.w3.org/mid/01f601c3820f$95724480$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7905
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030923201638.4C5CAA0565@frink.w3.org>
Resent-Date: Tue, 23 Sep 2003 16:16:38 -0400 (EDT)
Content-Transfer-Encoding: quoted-printable



It's time to last-call ACL again.  If you recall, ACL was brought to =
last call a year ago.  IESG review brought up a couple issues with how =
carefully delete privilege was defined and suggested simplification =
among the server options (particularly in the order-of-evaluation of =
ACEs).  These changes have been made and we've now spent quite a long =
time discussing those changes and other ideas.  I'm not aware of any =
outstanding issues besides one nit in acl-restrictions which Geoff =
probably already dealt with.

So, this begins a two-week period in which anybody can make comments on =
the ACL draft.  After this period if we've only found minor issues/nits, =
we'll resubmit it to the IESG.  I don't know yet if that will involve =
another IETF last call so I recommend you review ACL now.

Various formats available here: http://www.webdav.org/acl/
Official draft location: =
http://www.ietf.org/internet-drafts/draft-ietf-webdav-acl-11.txt

Lisa




From w3c-dist-auth-request@w3.org  Wed Sep 24 05:45:20 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA04221
	for <webdav-archive@lists.ietf.org>; Wed, 24 Sep 2003 05:45:20 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 12438A0581; Wed, 24 Sep 2003 05:45:27 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 58FF5A05D0
	for <w3c-dist-auth@frink.w3.org>; Wed, 24 Sep 2003 05:45:21 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 2816813AB4; Wed, 24 Sep 2003 05:45:21 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 8EED1137C0
	for <w3c-dist-auth@w3.org>; Wed, 24 Sep 2003 05:45:20 -0400 (EDT)
Received: (qmail 2916 invoked by uid 65534); 24 Sep 2003 09:45:19 -0000
Received: from unknown (HELO lisa) (217.5.201.10)
  by mail.gmx.net (mp009) with SMTP; 24 Sep 2003 11:45:19 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Lisa Dusseault" <lisa@xythos.com>,
        "'Geoffrey M Clemm'" <geoffrey.clemm@us.ibm.com>,
        <w3c-dist-auth@w3.org>
Date: Wed, 24 Sep 2003 11:45:16 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCCEJFIJAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
In-Reply-To: <000a01c38128$3ae8b4f0$f8cb90c6@lisalap>
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCCEJFIJAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7906
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030924094527.12438A0581@frink.w3.org>
Resent-Date: Wed, 24 Sep 2003 05:45:27 -0400 (EDT)
Content-Transfer-Encoding: 7bit


BTW:

the current discussion is a very good example why the new DTD usage in
RFC2518bis is IMHO a bad idea -- it doesn't state anymore which child
elements are mandatory.

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Lisa Dusseault
> Sent: Monday, September 22, 2003 6:40 PM
> To: 'Geoffrey M Clemm'; w3c-dist-auth@w3.org
> Subject: RE: ACL and lockdiscovery
>
>
>
> >
> > For the question of why a lock token is ever sent back to the
> > client, (I assume you mean "in lock discovery" ... it of
> > course has to be sent back to the client creating the lock).
> > The reason is that there can be several locks on a resource,
> > and the client may only want to UNLOCK a particular lock.
>
> Yes, this is important, and I'll add a bit more detail for client
> considerations:
>
> 1. The client MUST remember the lock token and/or put some
>    self-identifying information in the owner field of the lock
>    That's because if I'm running two WebDAV clients, possibly
>    either on the same computer or two different computers but
>    both logged in as me, those two clients need to use only their
>    own locks.  It would mess things up if my synchronization client
>    used the lock token taken out by my authoring client and
>    overwrote all my new changes.  It's not enough to be the user
>    that owns the lock, the client must also be the same client (or
>    coordinating with the same client) that took out the lock.
>
> 2. If the server doesn't provide the lock token in the lock discovery
>    property value, how are client supposed to know *which* locks
>    are currently on the resource?   The lock token is currently the
>    only way to identify a lock.  This information can help the client
>    figure out what's going on -- e.g. to be confident that the lock
>    that the client requested an hour ago is still valid.
>
> Lisa
>
> >
> > Cheers,
> > Geoff
> >
> > Guido wrote on 09/21/2003 05:52:24 AM:
> >
> > > I dare to disagree.
> > > The lock token ALLOWS clients to be written for the behaviour Geoff
> > > describes (2 clients working on behalf of the same user
> > cannot unlock
> > > each others lock).
> > >
> > > But does that imply that clients acommodating the use case
> > of wanting
> > > to unlock another client's lock are not compliant? Why
> > would the lock
> > > token then be sent back to the client ever (instead of just
> > a general
> > > locking state)?
> > >
> > > Guido
> > >
> > >
> > > Geoffrey M Clemm <geoffrey.clemm@us.ibm.com> wrote:
> > > > If the client doesn't have permission to do an UNLOCK,
> > > > or if the lock automatically times out
> > > > (the two use cases identified where the server is likely
> > to withhold
> > > > the lock token), the client either cannot do an UNLOCK,
> > or does not
> > > > need to do an UNLOCK.
> > > >
> > > > WRT clients that do not store the lock tokens, but rather try to
> > > > steal any lock token that is allowed by access control, this
> > > > violates the whole point of having lock tokens instead of just a
> > > > server-side lock (i.e. preventing two clients working on
> > behalf of
> > > > the same user from stomping on each other),
> > > > and such a client should be fixed, not catered to by servers.
> > > >
> > > > Cheers,
> > > > Geoff
> > > >
> > > > "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003
> > 12:32:20 PM:
> > > >
> > > >> Unfortunately, withholding the locktoken from the client that
> > > >> requested that lock would break UNLOCK for some clients
> > that don't
> > > >> store their own lock tokens. Those clients might show error
> > > >> messages & cause support calls.
> > > >> Thus, as a matter of interoperability, a server would at
> > least have
> > > >> to be careful in providing incomplete information in
> > lockdiscovery.
> > > >>
> > > >> This area is murkier than I had thought.  Should there be a
> > > >> clarification in RFC2518bis? It would obviously be
> > easier to write
> > > >> interoperable clients if all servers had to behave the
> > same in this
> > > >> area.  Is there a de facto
> > > >
> > > >> minimum standard here that we can clarify in the next rev?
> > > >>
> > > >> lisa
> > > >> -----Original Message-----
> > > >> From: w3c-dist-auth-request@w3.org
> > > >> [mailto:w3c-dist-auth-request@w3.org]
> > > >
> > > >> On Behalf Of Geoffrey M Clemm
> > > >> Sent: Thursday, September 18, 2003 5:17 AM
> > > >> To: w3c-dist-auth@w3.org
> > > >> Subject: RE: ACL and lockdiscovery
> > > >
> > > >>
> > > >> That is not correct.  RFC-2518 explicitly states in section 13.8
> > > >> (where the DAV:lockdiscovery property is defined):
> > > >>
> > > >> "The server is free to withhold any or all of this
> > information if
> > > >> the requesting principal does not have sufficient access
> > rights to
> > > >> see the requested data."
> > > >>
> > > >> In particular, if the client does not have sufficient
> > access rights
> > > >> to UNLOCK the resource, a server could very reasonably choose to
> > > >> hide the lock-token information.
> > > >>
> > > >> In addition, a server for which locks have a reasonably short
> > > >> maximum expiration may chose to never expose the lock
> > tokens (i.e.
> > > >> nobody has sufficient access rights to see the lock tokens).
> > > >>
> > > >> Cheers,
> > > >> Geoff
> > > >>
> > > >> w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
> > > >>
> > > >>>
> > > >>> I'd also point out that the lockdiscovery property MUST contain
> > > >>> all the lock tokens, regardless of access control
> > settings.  This
> > > >>> is not considered a security leak, because
> > authorization is also
> > > >>> needed to use a lock token.  So this is the server
> > logic to apply
> > > >>> whenever the client provides a lock token:
> > > >>>
> > > >>> Is this the same authorization context that took out the lock?
> > > >>>   Yes {
> > > >>>    Allow the operation normally, provided the operation is
> > > >>>    allowed, and provided the lock token is correct and all
> > > >>>    required lock tokens are provided, etc.
> > > >>>   } No {
> > > >>>    Is this an UNLOCK operation, with an authorization that
> > > >>>    includes permission to delete others' locks?
> > > >>>    Yes {
> > > >>>       perform UNLOCK
> > > >>>    } No {
> > > >>>       Fail request
> > > >>>    }
> > > >>>   }
> > > >>>
> > > >>> Lisa
> > > >>>
> > > >>>> -----Original Message-----
> > > >>>> From: w3c-dist-auth-request@w3.org
> > > >>>> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric Sedlar
> > > >>>> Sent: Wednesday, September 17, 2003 11:17 AM
> > > >>>> To: 'Horst Liermann'; w3c-dist-auth@w3.org
> > > >>>> Subject: RE: ACL and lockdiscovery
> > > >>>>
> > > >>>>
> > > >>>>
> > > >>>> The ACL spec hasn't defined a privilege specifically
> > to control
> > > >>>> read access to the lockdiscovery property, or even a
> > privilege to
> > > >>>> control access to all the privileges in total. An individual
> > > >>>> server implementation could provide such a privilege and
> > > >>>> aggregate it under <dav:read>, but this isn't required.
> > > >>>>
> > > >>>> --Eric
> > > >>>>
> > > >>>>> -----Original Message-----
> > > >>>>> From: w3c-dist-auth-request@w3.org
> > > >>>>> [mailto:w3c-dist-auth-request@w3.org]
> > > >>>>> On Behalf Of Horst Liermann
> > > >>>>> Sent: Wednesday, September 17, 2003 10:08 AM
> > > >>>>> To: 'w3c-dist-auth@w3.org'
> > > >>>>>
> > > >>>>>
> > > >>>>> Hi all,
> > > >>>>>
> > > >>>>> some questions about lockdiscovery and ACL's
> > > >>>>>
> > > >>>>> Suppose, you have a server with WebDAV ( including
> > lock) and it
> > > >>>>> support's ACL. What is the behavior for lockdiscovery, can
> > > >>>> I see all
> > > >>>>> lock token or am I only allowed to see the tokens where I
> > > >>>> am the owner
> > > >>>>> of the lock ? As far as I understand, lockdiscovery reports
> > > >>>> all locks.
> > > >>>>> Is this a security leak ?
> > > >>>>>
> > > >>>>> Best Regards
> > > >>>>>    Horst
> > >
> >
> >
>
>



From w3c-dist-auth-request@w3.org  Wed Sep 24 12:33:10 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA25167
	for <webdav-archive@lists.ietf.org>; Wed, 24 Sep 2003 12:33:09 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 4C1E7A0C24; Wed, 24 Sep 2003 12:33:13 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 2FF9AA0E46
	for <w3c-dist-auth@frink.w3.org>; Wed, 24 Sep 2003 12:32:59 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 5D39613DE9; Wed, 24 Sep 2003 12:31:54 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id F3D4213DE5
	for <w3c-dist-auth@w3.org>; Wed, 24 Sep 2003 12:31:53 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 1A2CYQ-0002vi-00; Wed, 24 Sep 2003 16:31:50 +0000
Received: from [198.144.203.248] (helo=lisalap)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 1A2CYO-0002v8-00; Wed, 24 Sep 2003 16:31:49 +0000
From: "Lisa Dusseault" <lisa@xythos.com>
To: "'Julian Reschke'" <julian.reschke@gmx.de>,
        "'Geoffrey M Clemm'" <geoffrey.clemm@us.ibm.com>,
        <w3c-dist-auth@w3.org>
Date: Wed, 24 Sep 2003 09:31:50 -0700
Message-ID: <007601c382b9$5baad9b0$f8cb90c6@lisalap>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook, Build 10.0.4510
Importance: Normal
In-Reply-To: <JIEGINCHMLABHJBIGKBCCEJFIJAA.julian.reschke@gmx.de>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Old-X-Envelope-To: geoffrey.clemm@us.ibm.com,
 julian.reschke@gmx.de,
 w3c-dist-auth@w3.org
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/007601c382b9$5baad9b0$f8cb90c6@lisalap
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7907
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030924163313.4C1E7A0C24@frink.w3.org>
Resent-Date: Wed, 24 Sep 2003 12:33:13 -0400 (EDT)
Content-Transfer-Encoding: quoted-printable


Yeah, it is a quandary.  On the one hand, if we include a DTD with =
elements
listed, implementors tend to barf when extra elements are sent.  On the
other
hand, if we don't list the required elements, implementors tend not to =
send=20
them. =20

What if we ditched the DTD entirely and simply use English?  Something =
like
this:

  'lockdiscovery' property (in 'DAV:' namespace):
	MUST contain one 'activelock' elements for each lock on the resource
	MUST be empty if no locks exist on the resource

  'activelock' element (in 'DAV:' namespace):
	MUST contain one 'locktype' element
	MUST contain one 'lockscope' element
	MUST contain one 'depth' element=20
	MAY contain one 'owner' element (MUST contain the value provided by
the client if one was provided)
		(MUST NOT contain more than one 'owner' element)
	MAY contain one 'timeout' element
		if omitted, timeout value MUST be infinite
	MUST contain one 'locktoken' element=20
	MAY contain additional elements which can be ignored=20


This would tend to drive us, the spec writers, to include more =
information,
more
guidance, rather than less.  That's because the DTDs don't provide an =
easy
place to say whether an element may be extended with new elements, or =
under
what conditions an element is required.

Lisa




> -----Original Message-----
> From: w3c-dist-auth-request@w3.org=20
> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Julian Reschke
> Sent: Wednesday, September 24, 2003 2:45 AM
> To: Lisa Dusseault; 'Geoffrey M Clemm'; w3c-dist-auth@w3.org
> Subject: RE: ACL and lockdiscovery
>=20
>=20
>=20
> BTW:
>=20
> the current discussion is a very good example why the new DTD=20
> usage in RFC2518bis is IMHO a bad idea -- it doesn't state=20
> anymore which child elements are mandatory.
>=20
> Julian
>=20
> --
> <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
>=20
> > -----Original Message-----
> > From: w3c-dist-auth-request@w3.org=20
> > [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Lisa Dusseault
> > Sent: Monday, September 22, 2003 6:40 PM
> > To: 'Geoffrey M Clemm'; w3c-dist-auth@w3.org
> > Subject: RE: ACL and lockdiscovery
> >
> >
> >
> > >
> > > For the question of why a lock token is ever sent back to the=20
> > > client, (I assume you mean "in lock discovery" ... it of=20
> course has=20
> > > to be sent back to the client creating the lock). The=20
> reason is that=20
> > > there can be several locks on a resource, and the client may only=20
> > > want to UNLOCK a particular lock.
> >
> > Yes, this is important, and I'll add a bit more detail for client
> > considerations:
> >
> > 1. The client MUST remember the lock token and/or put some
> >    self-identifying information in the owner field of the lock
> >    That's because if I'm running two WebDAV clients, possibly
> >    either on the same computer or two different computers but
> >    both logged in as me, those two clients need to use only their
> >    own locks.  It would mess things up if my synchronization client
> >    used the lock token taken out by my authoring client and
> >    overwrote all my new changes.  It's not enough to be the user
> >    that owns the lock, the client must also be the same client (or
> >    coordinating with the same client) that took out the lock.
> >
> > 2. If the server doesn't provide the lock token in the lock=20
> discovery
> >    property value, how are client supposed to know *which* locks
> >    are currently on the resource?   The lock token is currently the
> >    only way to identify a lock.  This information can help=20
> the client
> >    figure out what's going on -- e.g. to be confident that the lock
> >    that the client requested an hour ago is still valid.
> >
> > Lisa
> >
> > >
> > > Cheers,
> > > Geoff
> > >
> > > Guido wrote on 09/21/2003 05:52:24 AM:
> > >
> > > > I dare to disagree.
> > > > The lock token ALLOWS clients to be written for the behaviour=20
> > > > Geoff describes (2 clients working on behalf of the same user
> > > cannot unlock
> > > > each others lock).
> > > >
> > > > But does that imply that clients acommodating the use case
> > > of wanting
> > > > to unlock another client's lock are not compliant? Why
> > > would the lock
> > > > token then be sent back to the client ever (instead of just
> > > a general
> > > > locking state)?
> > > >
> > > > Guido
> > > >
> > > >
> > > > Geoffrey M Clemm <geoffrey.clemm@us.ibm.com> wrote:
> > > > > If the client doesn't have permission to do an=20
> UNLOCK, or if the=20
> > > > > lock automatically times out (the two use cases=20
> identified where=20
> > > > > the server is likely
> > > to withhold
> > > > > the lock token), the client either cannot do an UNLOCK,
> > > or does not
> > > > > need to do an UNLOCK.
> > > > >
> > > > > WRT clients that do not store the lock tokens, but=20
> rather try to=20
> > > > > steal any lock token that is allowed by access control, this=20
> > > > > violates the whole point of having lock tokens=20
> instead of just a=20
> > > > > server-side lock (i.e. preventing two clients working on
> > > behalf of
> > > > > the same user from stomping on each other),
> > > > > and such a client should be fixed, not catered to by servers.
> > > > >
> > > > > Cheers,
> > > > > Geoff
> > > > >
> > > > > "Lisa Dusseault" <lisa@xythos.com> wrote on 09/18/2003
> > > 12:32:20 PM:
> > > > >
> > > > >> Unfortunately, withholding the locktoken from the=20
> client that=20
> > > > >> requested that lock would break UNLOCK for some clients
> > > that don't
> > > > >> store their own lock tokens. Those clients might show error=20
> > > > >> messages & cause support calls. Thus, as a matter of=20
> > > > >> interoperability, a server would at
> > > least have
> > > > >> to be careful in providing incomplete information in
> > > lockdiscovery.
> > > > >>
> > > > >> This area is murkier than I had thought.  Should there be a=20
> > > > >> clarification in RFC2518bis? It would obviously be
> > > easier to write
> > > > >> interoperable clients if all servers had to behave the
> > > same in this
> > > > >> area.  Is there a de facto
> > > > >
> > > > >> minimum standard here that we can clarify in the next rev?
> > > > >>
> > > > >> lisa
> > > > >> -----Original Message-----
> > > > >> From: w3c-dist-auth-request@w3.org=20
> > > > >> [mailto:w3c-dist-auth-request@w3.org]
> > > > >
> > > > >> On Behalf Of Geoffrey M Clemm
> > > > >> Sent: Thursday, September 18, 2003 5:17 AM
> > > > >> To: w3c-dist-auth@w3.org
> > > > >> Subject: RE: ACL and lockdiscovery
> > > > >
> > > > >>
> > > > >> That is not correct.  RFC-2518 explicitly states in section=20
> > > > >> 13.8 (where the DAV:lockdiscovery property is defined):
> > > > >>
> > > > >> "The server is free to withhold any or all of this
> > > information if
> > > > >> the requesting principal does not have sufficient access
> > > rights to
> > > > >> see the requested data."
> > > > >>
> > > > >> In particular, if the client does not have sufficient
> > > access rights
> > > > >> to UNLOCK the resource, a server could very=20
> reasonably choose=20
> > > > >> to hide the lock-token information.
> > > > >>
> > > > >> In addition, a server for which locks have a=20
> reasonably short=20
> > > > >> maximum expiration may chose to never expose the lock
> > > tokens (i.e.
> > > > >> nobody has sufficient access rights to see the lock tokens).
> > > > >>
> > > > >> Cheers,
> > > > >> Geoff
> > > > >>
> > > > >> w3c-dist-auth-request@w3.org wrote on 09/17/2003 07:49:20 PM:
> > > > >>
> > > > >>>
> > > > >>> I'd also point out that the lockdiscovery property MUST=20
> > > > >>> contain all the lock tokens, regardless of access control
> > > settings.  This
> > > > >>> is not considered a security leak, because
> > > authorization is also
> > > > >>> needed to use a lock token.  So this is the server
> > > logic to apply
> > > > >>> whenever the client provides a lock token:
> > > > >>>
> > > > >>> Is this the same authorization context that took=20
> out the lock?
> > > > >>>   Yes {
> > > > >>>    Allow the operation normally, provided the operation is
> > > > >>>    allowed, and provided the lock token is correct and all
> > > > >>>    required lock tokens are provided, etc.
> > > > >>>   } No {
> > > > >>>    Is this an UNLOCK operation, with an authorization that
> > > > >>>    includes permission to delete others' locks?
> > > > >>>    Yes {
> > > > >>>       perform UNLOCK
> > > > >>>    } No {
> > > > >>>       Fail request
> > > > >>>    }
> > > > >>>   }
> > > > >>>
> > > > >>> Lisa
> > > > >>>
> > > > >>>> -----Original Message-----
> > > > >>>> From: w3c-dist-auth-request@w3.org=20
> > > > >>>> [mailto:w3c-dist-auth-request@w3.org] On Behalf Of Eric=20
> > > > >>>> Sedlar
> > > > >>>> Sent: Wednesday, September 17, 2003 11:17 AM
> > > > >>>> To: 'Horst Liermann'; w3c-dist-auth@w3.org
> > > > >>>> Subject: RE: ACL and lockdiscovery
> > > > >>>>
> > > > >>>>
> > > > >>>>
> > > > >>>> The ACL spec hasn't defined a privilege specifically
> > > to control
> > > > >>>> read access to the lockdiscovery property, or even a
> > > privilege to
> > > > >>>> control access to all the privileges in total. An=20
> individual=20
> > > > >>>> server implementation could provide such a privilege and=20
> > > > >>>> aggregate it under <dav:read>, but this isn't required.
> > > > >>>>
> > > > >>>> --Eric
> > > > >>>>
> > > > >>>>> -----Original Message-----
> > > > >>>>> From: w3c-dist-auth-request@w3.org=20
> > > > >>>>> [mailto:w3c-dist-auth-request@w3.org]
> > > > >>>>> On Behalf Of Horst Liermann
> > > > >>>>> Sent: Wednesday, September 17, 2003 10:08 AM
> > > > >>>>> To: 'w3c-dist-auth@w3.org'
> > > > >>>>>
> > > > >>>>>
> > > > >>>>> Hi all,
> > > > >>>>>
> > > > >>>>> some questions about lockdiscovery and ACL's
> > > > >>>>>
> > > > >>>>> Suppose, you have a server with WebDAV ( including
> > > lock) and it
> > > > >>>>> support's ACL. What is the behavior for lockdiscovery, can
> > > > >>>> I see all
> > > > >>>>> lock token or am I only allowed to see the tokens where I
> > > > >>>> am the owner
> > > > >>>>> of the lock ? As far as I understand,=20
> lockdiscovery reports
> > > > >>>> all locks.
> > > > >>>>> Is this a security leak ?
> > > > >>>>>
> > > > >>>>> Best Regards
> > > > >>>>>    Horst
> > > >
> > >
> > >
> >
> >
>=20
>=20




From w3c-dist-auth-request@w3.org  Wed Sep 24 12:59:26 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAB26400
	for <webdav-archive@lists.ietf.org>; Wed, 24 Sep 2003 12:59:26 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 2ED0EA075B; Wed, 24 Sep 2003 12:58:21 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 6B5B4A075B
	for <w3c-dist-auth@frink.w3.org>; Wed, 24 Sep 2003 12:58:12 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 2008113A43; Wed, 24 Sep 2003 12:58:12 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id AC130137DF
	for <w3c-dist-auth@w3.org>; Wed, 24 Sep 2003 12:58:11 -0400 (EDT)
Received: (qmail 970 invoked by uid 65534); 24 Sep 2003 16:58:11 -0000
Received: from unknown (HELO lisa) (217.5.201.10)
  by mail.gmx.net (mp006) with SMTP; 24 Sep 2003 18:58:11 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Lisa Dusseault" <lisa@xythos.com>,
        "'Julian Reschke'" <julian.reschke@gmx.de>,
        "'Geoffrey M Clemm'" <geoffrey.clemm@us.ibm.com>,
        <w3c-dist-auth@w3.org>
Date: Wed, 24 Sep 2003 18:58:10 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCOEKIIJAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
In-Reply-To: <007601c382b9$5baad9b0$f8cb90c6@lisalap>
Subject: RE: ACL and lockdiscovery
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCOEKIIJAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7908
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030924165821.2ED0EA075B@frink.w3.org>
Resent-Date: Wed, 24 Sep 2003 12:58:21 -0400 (EDT)
Content-Transfer-Encoding: 7bit


> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Lisa Dusseault
> Sent: Wednesday, September 24, 2003 6:32 PM
> To: 'Julian Reschke'; 'Geoffrey M Clemm'; w3c-dist-auth@w3.org
> Subject: RE: ACL and lockdiscovery
>
>
>
> Yeah, it is a quandary.  On the one hand, if we include a DTD  with
elements
> listed, implementors tend to barf when extra elements are sent.  On the
other
> hand, if we don't list the required elements, implementors tend not to
send
> them.
>
> What if we ditched the DTD entirely and simply use English?

I'd prefer to keep them and continue to use them the same way as currently
done in RFC2518, RFC3253 and the various drafts closing completion.

All that's needed is the following general clarification:

"This document uses XML DTD fragments as a purely notational convention.
WebDAV request and response bodies can not be validated due to the specific
extensibility rules defined in section 23 of [RFC2518] and due to the fact
that all XML elements defined by this specification use the XML namespace
name "DAV:". In particular:

- element names use the "DAV:" namespace,
- element ordering is irrelevant,
- extension elements (elements not already defined as valid child elements)
may be added anywhere, except when explicitly stated otherwise,
- extension attributes (attributes not already defined as valid for this
element) may be added anywhere, except when explicitly stated otherwise."

(see
<http://greenbytes.de/tech/webdav/draft-ietf-webdav-ordering-protocol-10.htm
l#rfc.section.1>).

This reduces changes to existing and currently last-called documents to a
minimum, clarifies (hopefully all) issue and keeps the readability of DTDs.

> Something like
> this:
>
>   'lockdiscovery' property (in 'DAV:' namespace):
> 	MUST contain one 'activelock' elements for each lock on the resource
> 	MUST be empty if no locks exist on the resource
>
>   'activelock' element (in 'DAV:' namespace):
> 	MUST contain one 'locktype' element
> 	MUST contain one 'lockscope' element
> 	MUST contain one 'depth' element
> 	MAY contain one 'owner' element (MUST contain the value provided by
> the client if one was provided)
> 		(MUST NOT contain more than one 'owner' element)
> 	MAY contain one 'timeout' element
> 		if omitted, timeout value MUST be infinite
> 	MUST contain one 'locktoken' element
> 	MAY contain additional elements which can be ignored
>
>
> This would tend to drive us, the spec writers, to include more
> information,
> more
> guidance, rather than less.  That's because the DTDs don't provide an easy
> place to say whether an element may be extended with new
> elements, or under
> what conditions an element is required.

If this is the main issue, clarifying that an "ANY" content model indicates
that the element is *not* extensible (contrary to the default case) may
suffice (note that this would apply to the content of the DAV:prop element
in PROPFIND marshalling).

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760




From w3c-dist-auth-request@w3.org  Wed Sep 24 13:00:53 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA26472
	for <webdav-archive@lists.ietf.org>; Wed, 24 Sep 2003 13:00:53 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 15912A061A; Wed, 24 Sep 2003 13:01:00 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id EED5FA051F
	for <w3c-dist-auth@frink.w3.org>; Wed, 24 Sep 2003 13:00:53 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id A4044133A1; Wed, 24 Sep 2003 13:00:53 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (mail.gmx.net [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 31A1C131D4
	for <w3c-dist-auth@w3.org>; Wed, 24 Sep 2003 13:00:53 -0400 (EDT)
Received: (qmail 19672 invoked by uid 65534); 24 Sep 2003 17:00:52 -0000
Received: from unknown (HELO lisa) (217.5.201.10)
  by mail.gmx.net (mp014) with SMTP; 24 Sep 2003 19:00:52 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: <w3c-dist-auth@w3.org>
Date: Wed, 24 Sep 2003 19:00:51 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCEEKJIJAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
Subject: new edits on redirect ref spec
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCEEKJIJAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7909
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030924170100.15912A061A@frink.w3.org>
Resent-Date: Wed, 24 Sep 2003 13:01:00 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Hi,

I've updated
<http://greenbytes.de/tech/webdav/draft-ietf-webdav-redirectref-protocol-lat
est.html> to

- clarify that MKRESOURCE can solely used to create redirect references
(atomically) and
- clarify that redirect references do not have entity bodies.

The plan is to submit this version as a new consolidated draft before we
actually execute the already agreed-upon plan of replacing MKRESOURSE by a
less complex and redirect-ref-specific creation method.

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760



From w3c-dist-auth-request@w3.org  Wed Sep 24 19:40:29 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA15213
	for <webdav-archive@lists.ietf.org>; Wed, 24 Sep 2003 19:40:28 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id D49BFA05A6; Wed, 24 Sep 2003 19:40:33 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 51220A05A6
	for <w3c-dist-auth@frink.w3.org>; Wed, 24 Sep 2003 19:40:31 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 292A4136DA; Wed, 24 Sep 2003 19:40:31 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from asgard.ietf.org (asgard.ietf.org [132.151.6.40])
	by dr-nick.w3.org (Postfix) with ESMTP id 17C98136D6
	for <w3c-dist-auth@w3.org>; Wed, 24 Sep 2003 19:40:31 -0400 (EDT)
Received: from apache by asgard.ietf.org with local (Exim 4.14)
	id 1A2JCh-0006z0-2d; Wed, 24 Sep 2003 19:37:51 -0400
X-test-idtracker: no
From: The IESG <iesg-secretary@ietf.org>
To: IETF-Announce: ;
Cc: Internet Architecture Board <iab@iab.org>,
        RFC Editor <rfc-editor@rfc-editor.org>, <w3c-dist-auth@w3.org>
Message-Id: <E1A2JCh-0006z0-2d@asgard.ietf.org>
Date: Wed, 24 Sep 2003 19:37:51 -0400
Subject: Protocol Action: 'WebDAV Ordered Collections Protocol' to           Proposed Standard 
X-Archived-At: http://www.w3.org/mid/E1A2JCh-0006z0-2d@asgard.ietf.org
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7910
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030924234033.D49BFA05A6@frink.w3.org>
Resent-Date: Wed, 24 Sep 2003 19:40:33 -0400 (EDT)


The IESG has approved following document:

- 'WebDAV Ordered Collections Protocol '
   <draft-ietf-webdav-ordering-protocol-10.txt> as a Proposed Standard

This document is the product of the WWW Distributed Authoring and 
Versioning Working Group. 

The IESG contact persons are Ted Hardie and Ned Freed.

Technical Summary

    The document extends the WebDAV Distributed Authoring Protocol
    to support server-side ordering of collection members, for use
    when a client's use of the search protocol's ordering option would
    not be appropriate or sufficient. It defines protocol elements that
    permit clients to specify the position of each member of a collection
    in an ordering. One common use case that has been discussed is
    maintaining markers like page numbers.



Working Group Summary

The working group held a four week last call on the document and
comments received were generally positive. There was one set of
comments received during IETF last call, and the authors revised
the documents to handle the issues. The working group acknowledged
that problem it faced represented choices among several sets of
engineering trade offs, and it believes it has come to consensus on
those trade-offs.

Note that the document specifies methods of handling client-specified
but server-maintained orderings. The presumption of this work is
that a human will generally use a webdav client to create and maintain
these orderings. The working group aims to allow further extensions
to describe automatic, server-maintained orderings, but this document
does not specify those mechanisms.


Protocol Quality

Ted Hardie reviewed this document for the IESG.



From w3c-dist-auth-request@w3.org  Wed Sep 24 20:18:01 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA16465
	for <webdav-archive@lists.ietf.org>; Wed, 24 Sep 2003 20:18:00 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 11263A08D6; Wed, 24 Sep 2003 20:18:06 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 6BA3CA08D6
	for <w3c-dist-auth@frink.w3.org>; Wed, 24 Sep 2003 20:18:03 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 5917013919; Wed, 24 Sep 2003 20:18:01 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ucsc.edu (cats-mx1.ucsc.edu [128.114.129.36])
	by dr-nick.w3.org (Postfix) with ESMTP id DDA4413774
	for <w3c-dist-auth@w3.org>; Wed, 24 Sep 2003 20:18:00 -0400 (EDT)
Received: from Tycho (dhcp-55-196.cse.ucsc.edu [128.114.55.196])
	by ucsc.edu (8.10.1/8.10.1) with SMTP id h8P0G5a26322;
	Wed, 24 Sep 2003 17:16:05 -0700 (PDT)
From: "Jim Whitehead" <ejw@cse.ucsc.edu>
To: <w3c-dist-auth@w3.org>
Cc: <JSlein@crt.xerox.com>
Date: Wed, 24 Sep 2003 17:17:55 -0700
Message-ID: <AMEPKEBLDJJCCDEJHAMIEEHGJHAA.ejw@cse.ucsc.edu>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
In-Reply-To: <E1A2JCh-0006z0-2d@asgard.ietf.org>
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
X-UCSC-CATS-MailScanner: Found to be clean
Subject: RE: Protocol Action: 'WebDAV Ordered Collections Protocol' to           Proposed Standard 
X-Archived-At: http://www.w3.org/mid/AMEPKEBLDJJCCDEJHAMIEEHGJHAA.ejw@cse.ucsc.edu
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7911
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030925001806.11263A08D6@frink.w3.org>
Resent-Date: Wed, 24 Sep 2003 20:18:06 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Yeah! Congratulations to Julian Reschke for his diligent work bringing this
document to completion. Big thanks as well to Judy Slein, who initiated this
protocol and performed a sigificant amount of design work.

At this point the protocol goes to the RFC Editor, and will be issued as an
Proposed Standard RFC sometime in the next few months. This is the first
rung on the IETF's standards track.

- Jim

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of The IESG
> Sent: Wednesday, September 24, 2003 4:38 PM
> To: IETF-Announce:
> Cc: Internet Architecture Board; RFC Editor; w3c-dist-auth@w3.org
> Subject: Protocol Action: 'WebDAV Ordered Collections Protocol' to
> Proposed Standard
>
>
>
> The IESG has approved following document:
>
> - 'WebDAV Ordered Collections Protocol '
>    <draft-ietf-webdav-ordering-protocol-10.txt> as a Proposed Standard
>
> This document is the product of the WWW Distributed Authoring and
> Versioning Working Group.
>
> The IESG contact persons are Ted Hardie and Ned Freed.
>
> Technical Summary
>
>     The document extends the WebDAV Distributed Authoring Protocol
>     to support server-side ordering of collection members, for use
>     when a client's use of the search protocol's ordering option would
>     not be appropriate or sufficient. It defines protocol elements that
>     permit clients to specify the position of each member of a collection
>     in an ordering. One common use case that has been discussed is
>     maintaining markers like page numbers.
>
>
>
> Working Group Summary
>
> The working group held a four week last call on the document and
> comments received were generally positive. There was one set of
> comments received during IETF last call, and the authors revised
> the documents to handle the issues. The working group acknowledged
> that problem it faced represented choices among several sets of
> engineering trade offs, and it believes it has come to consensus on
> those trade-offs.
>
> Note that the document specifies methods of handling client-specified
> but server-maintained orderings. The presumption of this work is
> that a human will generally use a webdav client to create and maintain
> these orderings. The working group aims to allow further extensions
> to describe automatic, server-maintained orderings, but this document
> does not specify those mechanisms.
>
>
> Protocol Quality
>
> Ted Hardie reviewed this document for the IESG.



From w3c-dist-auth-request@w3.org  Mon Sep 29 16:49:54 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA11325
	for <webdav-archive@lists.ietf.org>; Mon, 29 Sep 2003 16:49:54 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 65764A0605; Mon, 29 Sep 2003 16:50:00 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 9EF0AA0BF7
	for <w3c-dist-auth@frink.w3.org>; Mon, 29 Sep 2003 16:49:56 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 47D1213C22; Mon, 29 Sep 2003 16:49:56 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ucsc.edu (cats-mx2.ucsc.edu [128.114.129.35])
	by dr-nick.w3.org (Postfix) with ESMTP id A91891365D
	for <w3c-dist-auth@w3.org>; Mon, 29 Sep 2003 16:49:54 -0400 (EDT)
Received: from Tycho (dhcp-63-196.cse.ucsc.edu [128.114.63.196])
	by ucsc.edu (8.10.1/8.10.1) with SMTP id h8TKkYb08950;
	Mon, 29 Sep 2003 13:46:41 -0700 (PDT)
From: "Jim Whitehead" <ejw@cse.ucsc.edu>
To: "WebDAV" <w3c-dist-auth@w3.org>
Cc: <stefan.eissing@greenbytes.de>, <briank@xythos.com>,
        <julian.reschke@gmx.de>, <luther.j@apple.com>,
        "Lisa Dusseault" <lisa@xythos.com>
Date: Mon, 29 Sep 2003 13:47:52 -0700
Message-ID: <AMEPKEBLDJJCCDEJHAMIGEIJJIAA.ejw@cse.ucsc.edu>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
X-UCSC-CATS-MailScanner: Found to be clean
Subject: Current status of the quota specification
X-Archived-At: http://www.w3.org/mid/AMEPKEBLDJJCCDEJHAMIGEIJJIAA.ejw@cse.ucsc.edu
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7912
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030929205000.65764A0605@frink.w3.org>
Resent-Date: Mon, 29 Sep 2003 16:50:00 -0400 (EDT)
Content-Transfer-Encoding: 7bit


All,

It seems that we're not making additional progress on the quota
specification.

My recollection from talking to Lisa is that another version of the
specification is ready to be submitted as an Internet-Draft. Is there belief
that we could start a WG last call on this draft once it was issued, or are
there still outstanding issues (or do you need to read the next draft to
determine this).

I think we're very close to completion on this work, it just needs a little
bit of additional work to bring it to completion.

- Jim



From w3c-dist-auth-request@w3.org  Mon Sep 29 17:00:28 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA11903
	for <webdav-archive@lists.ietf.org>; Mon, 29 Sep 2003 17:00:28 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id EB5C0A0C14; Mon, 29 Sep 2003 17:00:29 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 555EDA0C14
	for <w3c-dist-auth@frink.w3.org>; Mon, 29 Sep 2003 17:00:27 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 024AA13C20; Mon, 29 Sep 2003 17:00:27 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ucsc.edu (cats-mx2.ucsc.edu [128.114.129.35])
	by dr-nick.w3.org (Postfix) with ESMTP
	id 788F013C1E; Mon, 29 Sep 2003 17:00:26 -0400 (EDT)
Received: from Tycho (dhcp-63-196.cse.ucsc.edu [128.114.63.196])
	by ucsc.edu (8.10.1/8.10.1) with SMTP id h8TKwJb13826;
	Mon, 29 Sep 2003 13:58:19 -0700 (PDT)
From: "Jim Whitehead" <ejw@cse.ucsc.edu>
To: "WebDAV" <w3c-dist-auth@w3.org>, <www-webdav-dasl@w3.org>
Date: Mon, 29 Sep 2003 13:59:37 -0700
Message-ID: <AMEPKEBLDJJCCDEJHAMIIEIKJIAA.ejw@cse.ucsc.edu>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
X-UCSC-CATS-MailScanner: Found to be clean
Subject: Future direction for DASL/WebDAV SEARCH
X-Archived-At: http://www.w3.org/mid/AMEPKEBLDJJCCDEJHAMIIEIKJIAA.ejw@cse.ucsc.edu
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7913
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030929210029.EB5C0A0C14@frink.w3.org>
Resent-Date: Mon, 29 Sep 2003 17:00:29 -0400 (EDT)
Content-Transfer-Encoding: 7bit


All,

I'm interested in people's thoughts on how to proceed with the DASL
specification.

The DASL protocol, in its current form, has a great deal of effort and
maturity. Its well-specified enough such that there are multiple
interoperating implementations. Though it has limitations, it is very useful
in its current form. This argues for issuing the current specification as an
RFC, either standards track or experimental.

On the other hand, there are many features that would be nice to have added.
Some imply significant changes, as with proper sort ordering and comparator
evaluation of dead properties which implies adding a type system to WebDAV
properties. As well, handling XML querying intelligently would be a plus,
but would also require much work. This argues for creating a new working
group to address further development of DASL. It might make sense to involve
a wider audience, perhaps by including people in the W3C community
interested in protocols for XML searching.

So, there are a couple of choices:

a) Do we issue current specification more-or-less as-is?
   i) as Proposed
   ii) as Experimental
b) Do we continue development of the specification?
   i) within WebDAV community only
     - as new WG? in DAV WG?
   ii) expand community to address Web/XML searching in general, not
necessarily focused on WebdAV
     - as IETF WG? as W3C activity?

There are probably other choices as well.

Let me know what your thoughts are.

Thanks!

- Jim



From w3c-dist-auth-request@w3.org  Mon Sep 29 17:18:24 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA12469
	for <webdav-archive@lists.ietf.org>; Mon, 29 Sep 2003 17:18:23 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 6FEF2A0C7B; Mon, 29 Sep 2003 17:18:29 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id A1535A0C7B
	for <w3c-dist-auth@frink.w3.org>; Mon, 29 Sep 2003 17:18:26 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 38E25133C1; Mon, 29 Sep 2003 17:18:26 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id E7AC913361
	for <w3c-dist-auth@w3.org>; Mon, 29 Sep 2003 17:18:25 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 1A45PR-0002tB-00; Mon, 29 Sep 2003 21:18:21 +0000
Received: from [192.168.1.50] (helo=xythos.com)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 1A45PR-0002t0-00; Mon, 29 Sep 2003 21:18:21 +0000
Date: Mon, 29 Sep 2003 14:18:23 -0700
Content-Type: text/plain; charset=US-ASCII; format=flowed
Mime-Version: 1.0 (Apple Message framework v552)
Cc: "WebDAV" <w3c-dist-auth@w3.org>
To: "Jim Whitehead" <ejw@cse.ucsc.edu>
From: Brian Korver <briank@xythos.com>
In-Reply-To: <AMEPKEBLDJJCCDEJHAMIGEIJJIAA.ejw@cse.ucsc.edu>
Message-Id: <750BEA39-F2C2-11D7-958D-000393751598@xythos.com>
Content-Transfer-Encoding: 7bit
X-Mailer: Apple Mail (2.552)
Old-X-Envelope-To: w3c-dist-auth@w3.org,
 ejw@cse.ucsc.edu
Subject: Re: Current status of the quota specification
X-Archived-At: http://www.w3.org/mid/750BEA39-F2C2-11D7-958D-000393751598@xythos.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7914
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030929211829.6FEF2A0C7B@frink.w3.org>
Resent-Date: Mon, 29 Sep 2003 17:18:29 -0400 (EDT)
Content-Transfer-Encoding: 7bit


draft-ietf-webdav-quota-03.txt was submitted on 9/4, but since
it's not up on the IETF site I just resubmitted it.

-brian
briank@xythos.com


On Monday, September 29, 2003, at 01:47  PM, Jim Whitehead wrote:

> All,
>
> It seems that we're not making additional progress on the quota
> specification.
>
> My recollection from talking to Lisa is that another version of the
> specification is ready to be submitted as an Internet-Draft. Is there 
> belief
> that we could start a WG last call on this draft once it was issued, 
> or are
> there still outstanding issues (or do you need to read the next draft 
> to
> determine this).
>
> I think we're very close to completion on this work, it just needs a 
> little
> bit of additional work to bring it to completion.
>
> - Jim
>




From w3c-dist-auth-request@w3.org  Tue Sep 30 02:26:24 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA09192
	for <webdav-archive@lists.ietf.org>; Tue, 30 Sep 2003 02:26:23 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id E8F2AA087B; Tue, 30 Sep 2003 02:26:28 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 8C85DA087B
	for <w3c-dist-auth@frink.w3.org>; Tue, 30 Sep 2003 02:26:26 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 139711346F; Tue, 30 Sep 2003 02:26:26 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (mail.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id 8CFBA13BDC
	for <w3c-dist-auth@w3.org>; Tue, 30 Sep 2003 02:26:25 -0400 (EDT)
Received: (qmail 514 invoked by uid 65534); 30 Sep 2003 06:26:17 -0000
Received: from pD950C257.dip.t-dialin.net (HELO lisa) (217.80.194.87)
  by mail.gmx.net (mp021) with SMTP; 30 Sep 2003 08:26:17 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Jim Whitehead" <ejw@cse.ucsc.edu>, "WebDAV" <w3c-dist-auth@w3.org>
Date: Tue, 30 Sep 2003 08:25:59 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCOEJBIKAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
In-Reply-To: <AMEPKEBLDJJCCDEJHAMIGEIJJIAA.ejw@cse.ucsc.edu>
Importance: Normal
Subject: RE: Current status of the quota specification
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCOEJBIKAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7915
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030930062628.E8F2AA087B@frink.w3.org>
Resent-Date: Tue, 30 Sep 2003 02:26:28 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Jim,

my concern with the quota specification is that everytime we discuss is,
Stefan, myself and others are raising concerns about semantics and
complexity of the spec, even suggesting much easier approaches that should
cover the use cases we've seen equally well (see thread starting with [1]).

I'd say that the lack of progress is mainly caused by these concerns not
being appropriately addressed. In particular as this is now a WebDAV working
group activity, I'd like to see a

- known-issues list (like it should be present for any working group draft)
and
- public discussion of changes *before* a new draft is submitted

Right now the draft seems to be handled like a private submission with very
limited visibility to the (interested parts of the) working group, and this
is really a shame.

Julian

[1] <http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/0314.html>

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

> -----Original Message-----
> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Jim Whitehead
> Sent: Monday, September 29, 2003 10:48 PM
> To: WebDAV
> Cc: stefan.eissing@greenbytes.de; briank@xythos.com;
> julian.reschke@gmx.de; luther.j@apple.com; Lisa Dusseault
> Subject: Current status of the quota specification
>
>
>
> All,
>
> It seems that we're not making additional progress on the quota
> specification.
>
> My recollection from talking to Lisa is that another version of the
> specification is ready to be submitted as an Internet-Draft. Is
> there belief
> that we could start a WG last call on this draft once it was
> issued, or are
> there still outstanding issues (or do you need to read the next draft to
> determine this).
>
> I think we're very close to completion on this work, it just
> needs a little
> bit of additional work to bring it to completion.
>
> - Jim
>



From w3c-dist-auth-request@w3.org  Tue Sep 30 03:46:15 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA11136
	for <webdav-archive@lists.ietf.org>; Tue, 30 Sep 2003 03:46:15 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id B97D8A0606; Tue, 30 Sep 2003 03:46:21 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 3DC16A0606
	for <w3c-dist-auth@frink.w3.org>; Tue, 30 Sep 2003 03:46:16 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 625F513605; Tue, 30 Sep 2003 03:46:04 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (mail.gmx.de [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id EAB99134FF
	for <w3c-dist-auth@w3.org>; Tue, 30 Sep 2003 03:46:03 -0400 (EDT)
Received: (qmail 10441 invoked by uid 65534); 30 Sep 2003 07:45:57 -0000
Received: from pD950C257.dip.t-dialin.net (HELO lisa) (217.80.194.87)
  by mail.gmx.net (mp012) with SMTP; 30 Sep 2003 09:45:57 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Jim Whitehead" <ejw@cse.ucsc.edu>, "WebDAV" <w3c-dist-auth@w3.org>,
        <www-webdav-dasl@w3.org>
Date: Tue, 30 Sep 2003 09:45:31 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCGEKDIKAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
In-Reply-To: <AMEPKEBLDJJCCDEJHAMIIEIKJIAA.ejw@cse.ucsc.edu>
Importance: Normal
Subject: RE: Future direction for DASL/WebDAV SEARCH
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCGEKDIKAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7916
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030930074621.B97D8A0606@frink.w3.org>
Resent-Date: Tue, 30 Sep 2003 03:46:21 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Jim,

funny coincidence - I was just in the process of raising the issue myself.

Let's start with a look at the open issues:

	<http://greenbytes.de/tech/webdav/draft-reschke-webdav-search-issues.html>

I think they mostly fall into two categories:

1) marshalling (these issues can probably be resolved quickly if we just get
enough people looking at them, trying to find a simple solution)

2) typing/sorting

During the Interim WG meeting in January, we discussed 2):

	<http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/0075.html>

In particular, I remember that we agreed that in order to get typing in DASL
right, we need it first implemented in the basic WebDAV property model. So
we should decide whether

a) we leave datatyping out of DASL, fix the remaining issues or

b) try to define basic datatyping in properties first, and then let DASL
build on it.

(In both cases I'd suggest to submit the draft as experimental).

I feel that b) is the way to go, because there doesn't seem to be a portable
way to have queries on non-string values unless we have a way to identify
them.

Our (that is greenbytes/SAP, not the WG :-) current proposal for datatype
marshalling in PROPFIND/PROPPATCH is here:


<http://greenbytes.de/tech/webdav/draft-reschke-webdav-property-datatypes-05
.html>

We dicussed this draft in January as well, and I think we need to decide on
the following issues to proceed:

- should this be a working group activity (my recollection: yes)

- do we need a separate requirements document (I'd say: no, let's just state
them in the Introduction)

- where should the discussion happen (DASL mailing list or WebDAV mailing
list)?

- should the draft concentrate just on data typing, or should it also try to
handle additional metadata just like it does now (hidden flag, protected
flag, displayname information)

I personally think that the core part of the draft is mature enough (it's
first version is over two years old, and since then, the core feature set
has been absolutely stable). So if we leave the advanced stuff out, we could
possibly get if finished very soon.

Julian

--
<green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760

> -----Original Message-----
> From: www-webdav-dasl-request@w3.org
> [mailto:www-webdav-dasl-request@w3.org]On Behalf Of Jim Whitehead
> Sent: Monday, September 29, 2003 11:00 PM
> To: WebDAV; www-webdav-dasl@w3.org
> Subject: Future direction for DASL/WebDAV SEARCH
>
>
>
> All,
>
> I'm interested in people's thoughts on how to proceed with the DASL
> specification.
>
> The DASL protocol, in its current form, has a great deal of effort and
> maturity. Its well-specified enough such that there are multiple
> interoperating implementations. Though it has limitations, it is
> very useful
> in its current form. This argues for issuing the current
> specification as an
> RFC, either standards track or experimental.
>
> On the other hand, there are many features that would be nice to
> have added.
> Some imply significant changes, as with proper sort ordering and
> comparator
> evaluation of dead properties which implies adding a type system to WebDAV
> properties. As well, handling XML querying intelligently would be a plus,
> but would also require much work. This argues for creating a new working
> group to address further development of DASL. It might make sense
> to involve
> a wider audience, perhaps by including people in the W3C community
> interested in protocols for XML searching.
>
> So, there are a couple of choices:
>
> a) Do we issue current specification more-or-less as-is?
>    i) as Proposed
>    ii) as Experimental
> b) Do we continue development of the specification?
>    i) within WebDAV community only
>      - as new WG? in DAV WG?
>    ii) expand community to address Web/XML searching in general, not
> necessarily focused on WebdAV
>      - as IETF WG? as W3C activity?
>
> There are probably other choices as well.
>
> Let me know what your thoughts are.
>
> Thanks!
>
> - Jim
>
>



From w3c-dist-auth-request@w3.org  Tue Sep 30 13:51:13 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA04374
	for <webdav-archive@lists.ietf.org>; Tue, 30 Sep 2003 13:51:13 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 56B43A0718; Tue, 30 Sep 2003 13:51:18 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 60D32A0718
	for <w3c-dist-auth@frink.w3.org>; Tue, 30 Sep 2003 13:51:15 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 26D321351C; Tue, 30 Sep 2003 13:51:15 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id EA09C1336C
	for <w3c-dist-auth@w3.org>; Tue, 30 Sep 2003 13:51:14 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 1A4OeV-0004XQ-00; Tue, 30 Sep 2003 17:51:11 +0000
Received: from [192.168.1.50] (helo=xythos.com)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 1A4OeV-0004XF-00; Tue, 30 Sep 2003 17:51:11 +0000
Date: Tue, 30 Sep 2003 10:51:09 -0700
Content-Type: text/plain; delsp=yes; charset=US-ASCII; format=flowed
Mime-Version: 1.0 (Apple Message framework v552)
Cc: "WebDAV" <w3c-dist-auth@w3.org>
To: "Julian Reschke" <julian.reschke@gmx.de>
From: Brian Korver <briank@xythos.com>
In-Reply-To: <JIEGINCHMLABHJBIGKBCOEJBIKAA.julian.reschke@gmx.de>
Message-Id: <AC99CBBC-F36E-11D7-958D-000393751598@xythos.com>
Content-Transfer-Encoding: 7bit
X-Mailer: Apple Mail (2.552)
Old-X-Envelope-To: w3c-dist-auth@w3.org,
 julian.reschke@gmx.de
Subject: Re: Current status of the quota specification
X-Archived-At: http://www.w3.org/mid/AC99CBBC-F36E-11D7-958D-000393751598@xythos.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7917
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030930175118.56B43A0718@frink.w3.org>
Resent-Date: Tue, 30 Sep 2003 13:51:18 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Julian,

I didn't realize there were any known issues.  Unless I'm mistaken,
the only "fix" that didn't get into -03 was a suggestion by you
to add an additional definition, and I was waiting from text from
you for that.

Also note that there were no changes made that were not discussed
on the list.

-brian
briank@xythos.com

On Monday, September 29, 2003, at 11:25  PM, Julian Reschke wrote:
> Jim,
>
> my concern with the quota specification is that everytime we discuss  
> is,
> Stefan, myself and others are raising concerns about semantics and
> complexity of the spec, even suggesting much easier approaches that  
> should
> cover the use cases we've seen equally well (see thread starting with  
> [1]).
>
> I'd say that the lack of progress is mainly caused by these concerns  
> not
> being appropriately addressed. In particular as this is now a WebDAV  
> working
> group activity, I'd like to see a
>
> - known-issues list (like it should be present for any working group  
> draft)
> and
> - public discussion of changes *before* a new draft is submitted
>
> Right now the draft seems to be handled like a private submission with  
> very
> limited visibility to the (interested parts of the) working group, and  
> this
> is really a shame.
>
> Julian
>
> [1]  
> <http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/ 
> 0314.html>
>
> --
> <green/>bytes GmbH -- http://www.greenbytes.de -- tel:+492512807760
>
>> -----Original Message-----
>> From: w3c-dist-auth-request@w3.org
>> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Jim Whitehead
>> Sent: Monday, September 29, 2003 10:48 PM
>> To: WebDAV
>> Cc: stefan.eissing@greenbytes.de; briank@xythos.com;
>> julian.reschke@gmx.de; luther.j@apple.com; Lisa Dusseault
>> Subject: Current status of the quota specification
>>
>>
>>
>> All,
>>
>> It seems that we're not making additional progress on the quota
>> specification.
>>
>> My recollection from talking to Lisa is that another version of the
>> specification is ready to be submitted as an Internet-Draft. Is
>> there belief
>> that we could start a WG last call on this draft once it was
>> issued, or are
>> there still outstanding issues (or do you need to read the next draft  
>> to
>> determine this).
>>
>> I think we're very close to completion on this work, it just
>> needs a little
>> bit of additional work to bring it to completion.
>>
>> - Jim
>>
>
>
>




From w3c-dist-auth-request@w3.org  Tue Sep 30 14:06:00 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA04984
	for <webdav-archive@lists.ietf.org>; Tue, 30 Sep 2003 14:06:00 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id BDCE6A0B9F; Tue, 30 Sep 2003 14:06:04 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id B505DA0C19
	for <w3c-dist-auth@frink.w3.org>; Tue, 30 Sep 2003 14:05:56 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 56385135EC; Tue, 30 Sep 2003 14:05:56 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.gmx.net (imap.gmx.net [213.165.64.20])
	by dr-nick.w3.org (Postfix) with SMTP id DF45D1351C
	for <w3c-dist-auth@w3.org>; Tue, 30 Sep 2003 14:05:55 -0400 (EDT)
Received: (qmail 8304 invoked by uid 65534); 30 Sep 2003 18:05:53 -0000
Received: from p3EE24775.dip.t-dialin.net (HELO lisa) (62.226.71.117)
  by mail.gmx.net (mp005) with SMTP; 30 Sep 2003 20:05:53 +0200
X-Authenticated: #1915285
From: "Julian Reschke" <julian.reschke@gmx.de>
To: "Brian Korver" <briank@xythos.com>,
        "Julian Reschke" <julian.reschke@gmx.de>
Cc: "WebDAV" <w3c-dist-auth@w3.org>
Date: Tue, 30 Sep 2003 20:05:50 +0200
Message-ID: <JIEGINCHMLABHJBIGKBCEEMGIKAA.julian.reschke@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0)
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Importance: Normal
In-Reply-To: <AC99CBBC-F36E-11D7-958D-000393751598@xythos.com>
Subject: RE: Current status of the quota specification
X-Archived-At: http://www.w3.org/mid/JIEGINCHMLABHJBIGKBCEEMGIKAA.julian.reschke@gmx.de
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7918
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030930180604.BDCE6A0B9F@frink.w3.org>
Resent-Date: Tue, 30 Sep 2003 14:06:04 -0400 (EDT)
Content-Transfer-Encoding: 7bit


> From: w3c-dist-auth-request@w3.org
> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Brian Korver
> Sent: Tuesday, September 30, 2003 7:51 PM
> To: Julian Reschke
> Cc: WebDAV
> Subject: Re: Current status of the quota specification
>
>
>
> Julian,
>
> I didn't realize there were any known issues.  Unless I'm mistaken,

In which case we should go through all the mails that were exchanged between
January and March.

For instance:

<http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/0437.html>

<http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/0456.html>

<http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/0438.html>

<http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/0444.html>

<http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/0460.html>

<http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/0458.html>



> the only "fix" that didn't get into -03 was a suggestion by you
> to add an additional definition, and I was waiting from text from
> you for that.
>
>
> Also note that there were no changes made that were not discussed
> on the list.

Obviously there weren't any changes. No new draft was posted to the list or
published by the IETF. So could you please update the working group about
what the current draft is, and how it differs from the last published one
(which is the -01 draft published on March 07)?

Regards,

Julian



From w3c-dist-auth-request@w3.org  Tue Sep 30 14:16:02 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA05552
	for <webdav-archive@lists.ietf.org>; Tue, 30 Sep 2003 14:16:01 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 852B0A05F3; Tue, 30 Sep 2003 14:16:06 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id 7F17CA05F3
	for <w3c-dist-auth@frink.w3.org>; Tue, 30 Sep 2003 14:16:02 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 19096136A5; Tue, 30 Sep 2003 14:16:02 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from gate.arc.nasa.gov (gate.arc.nasa.gov [128.102.102.51])
	by dr-nick.w3.org (Postfix) with ESMTP id 911E5135EC
	for <w3c-dist-auth@w3.org>; Tue, 30 Sep 2003 14:16:01 -0400 (EDT)
Received: from nasa.gov (moonstone.aen.nasa.gov [198.123.13.108])
	by gate.arc.nasa.gov ( -- Info omitted by ASANI Solutions, LLC.) with ESMTP id h8UIFut01143;
	Tue, 30 Sep 2003 11:15:57 -0700 (PDT)
Message-ID: <3F79C86E.4030103@nasa.gov>
Date: Tue, 30 Sep 2003 11:16:14 -0700
From: Chris Knight <Christopher.D.Knight@nasa.gov>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.5b) Gecko/20030827
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Julian Reschke <julian.reschke@gmx.de>
Cc: Brian Korver <briank@xythos.com>, WebDAV <w3c-dist-auth@w3.org>
References: <JIEGINCHMLABHJBIGKBCEEMGIKAA.julian.reschke@gmx.de>
In-Reply-To: <JIEGINCHMLABHJBIGKBCEEMGIKAA.julian.reschke@gmx.de>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: Current status of the quota specification
X-Archived-At: http://www.w3.org/mid/3F79C86E.4030103@nasa.gov
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7919
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030930181606.852B0A05F3@frink.w3.org>
Resent-Date: Tue, 30 Sep 2003 14:16:06 -0400 (EDT)
Content-Transfer-Encoding: 7bit


Julian Reschke wrote:

>Obviously there weren't any changes. No new draft was posted to the list or
>published by the IETF. So could you please update the working group about
>what the current draft is, and how it differs from the last published one
>(which is the -01 draft published on March 07)?
>  
>

And can the current draft be posted to the working group web page under 
the "current draft documents" section? I have no idea what state the 
current draft is in. Thanks!



From w3c-dist-auth-request@w3.org  Tue Sep 30 14:56:58 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA07724
	for <webdav-archive@lists.ietf.org>; Tue, 30 Sep 2003 14:56:58 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id 64F2FA07A5; Tue, 30 Sep 2003 14:57:03 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id ACE7EA07A5
	for <w3c-dist-auth@frink.w3.org>; Tue, 30 Sep 2003 14:57:00 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id 673DD13776; Tue, 30 Sep 2003 14:57:00 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from mail.xythos.com (unknown [206.14.210.116])
	by dr-nick.w3.org (Postfix) with ESMTP id 4A76213745
	for <w3c-dist-auth@w3.org>; Tue, 30 Sep 2003 14:57:00 -0400 (EDT)
Received: from ravms by mail.xythos.com with mail-ok (Exim 3.36 #3)
	id 1A4Pg6-0005VN-00; Tue, 30 Sep 2003 18:56:54 +0000
Received: from [192.168.1.50] (helo=xythos.com)
	by mail.xythos.com with asmtp (Exim 3.36 #3)
	id 1A4Pfs-0005V9-00; Tue, 30 Sep 2003 18:56:52 +0000
Date: Tue, 30 Sep 2003 11:56:18 -0700
Content-Type: text/plain; delsp=yes; charset=US-ASCII; format=flowed
Mime-Version: 1.0 (Apple Message framework v552)
Cc: "WebDAV" <w3c-dist-auth@w3.org>
To: "Julian Reschke" <julian.reschke@gmx.de>
From: Brian Korver <briank@xythos.com>
In-Reply-To: <JIEGINCHMLABHJBIGKBCEEMGIKAA.julian.reschke@gmx.de>
Message-Id: <C60D230A-F377-11D7-958D-000393751598@xythos.com>
Content-Transfer-Encoding: 7bit
X-Mailer: Apple Mail (2.552)
Old-X-Envelope-To: w3c-dist-auth@w3.org,
 julian.reschke@gmx.de
Subject: Re: Current status of the quota specification
X-Archived-At: http://www.w3.org/mid/C60D230A-F377-11D7-958D-000393751598@xythos.com
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7920
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030930185703.64F2FA07A5@frink.w3.org>
Resent-Date: Tue, 30 Sep 2003 14:57:03 -0400 (EDT)
Content-Transfer-Encoding: 7bit


On Tuesday, September 30, 2003, at 11:05  AM, Julian Reschke wrote:
>> From: w3c-dist-auth-request@w3.org
>> [mailto:w3c-dist-auth-request@w3.org]On Behalf Of Brian Korver
>> Sent: Tuesday, September 30, 2003 7:51 PM
>> To: Julian Reschke
>> Cc: WebDAV
>> Subject: Re: Current status of the quota specification
>>
>>
>>
>> Julian,
>>
>> I didn't realize there were any known issues.  Unless I'm mistaken,
>
> In which case we should go through all the mails that were exchanged  
> between
> January and March.
>
> For instance:
>
> <http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/ 
> 0437.html>
>
> <http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/ 
> 0456.html>
>
> <http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/ 
> 0438.html>
>
> <http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/ 
> 0444.html>
>
> <http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/ 
> 0460.html>
>
> <http://lists.w3.org/Archives/Public/w3c-dist-auth/2003JanMar/ 
> 0458.html>
>
>
>
>> the only "fix" that didn't get into -03 was a suggestion by you
>> to add an additional definition, and I was waiting from text from
>> you for that.
>>
>>
>> Also note that there were no changes made that were not discussed
>> on the list.
>
> Obviously there weren't any changes. No new draft was posted to the  
> list or
> published by the IETF. So could you please update the working group  
> about
> what the current draft is, and how it differs from the last published  
> one
> (which is the -01 draft published on March 07)?

The status of the draft is that it has been submitted.  That should
result in it being posted on the IETF site RSN.


>
> Regards,
>
> Julian
>
>
>
-brian
briank@xythos.com




From w3c-dist-auth-request@w3.org  Tue Sep 30 15:37:53 2003
Received: from frink.w3.org (frink.w3.org [18.29.1.71])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA11198
	for <webdav-archive@lists.ietf.org>; Tue, 30 Sep 2003 15:37:53 -0400 (EDT)
Received: by frink.w3.org (Postfix, from userid 59936)
	id BE1DEA06B0; Tue, 30 Sep 2003 15:37:59 -0400 (EDT)
X-Original-To: w3c-dist-auth@frink.w3.org
Delivered-To: w3c-dist-auth@frink.w3.org
Received: from dr-nick.w3.org (dr-nick.w3.org [18.29.1.73])
	by frink.w3.org (Postfix) with ESMTP id D68BDA07CA
	for <w3c-dist-auth@frink.w3.org>; Tue, 30 Sep 2003 15:37:56 -0400 (EDT)
Received: by dr-nick.w3.org (Postfix)
	id B3A7A137C8; Tue, 30 Sep 2003 15:37:56 -0400 (EDT)
Delivered-To: w3c-dist-auth@w3.org
Received: from ietf.org (odin.ietf.org [132.151.1.176])
	by dr-nick.w3.org (Postfix) with ESMTP id 0563F133A4
	for <w3c-dist-auth@w3.org>; Tue, 30 Sep 2003 15:37:56 -0400 (EDT)
Received: from CNRI.Reston.VA.US (localhost [127.0.0.1])
	by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA11172;
	Tue, 30 Sep 2003 15:37:47 -0400 (EDT)
Message-Id: <200309301937.PAA11172@ietf.org>
Mime-Version: 1.0
Content-Type: Multipart/Mixed; Boundary="NextPart"
To: IETF-Announce: ;
Cc: w3c-dist-auth@w3.org
From: Internet-Drafts@ietf.org
Reply-To: Internet-Drafts@ietf.org
Date: Tue, 30 Sep 2003 15:37:47 -0400
Subject: I-D ACTION:draft-ietf-webdav-quota-02.txt
X-Archived-At: http://www.w3.org/mid/200309301937.PAA11172@ietf.org
Resent-From: w3c-dist-auth@w3.org
X-Mailing-List: <w3c-dist-auth@w3.org> archive/latest/7921
X-Loop: w3c-dist-auth@w3.org
Sender: w3c-dist-auth-request@w3.org
Resent-Sender: w3c-dist-auth-request@w3.org
Precedence: list
List-Id: <w3c-dist-auth.w3.org>
List-Help: <http://www.w3.org/Mail/>
List-Unsubscribe: <mailto:w3c-dist-auth-request@w3.org?subject=unsubscribe>
Resent-Message-Id: <20030930193759.BE1DEA06B0@frink.w3.org>
Resent-Date: Tue, 30 Sep 2003 15:37:59 -0400 (EDT)


--NextPart

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the WWW Distributed Authoring and Versioning Working Group of the IETF.

	Title		: Quota and Size Properties for DAV Collections
	Author(s)	: B. Korver, L. Dusseault, C. Warner
	Filename	: draft-ietf-webdav-quota-02.txt
	Pages		: 9
	Date		: 2003-9-30
	
WebDAV servers are frequently deployed with collection quota (size) 
limitations.  This Internet-Draft discusses the two properties and 
minor behaviors needed for clients to interoperate with quota 
implementations on WebDAV repositories.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-webdav-quota-02.txt

To remove yourself from the IETF Announcement list, send a message to 
ietf-announce-request with the word unsubscribe in the body of the message.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-webdav-quota-02.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt


Internet-Drafts can also be obtained by e-mail.

Send a message to:
	mailserv@ietf.org.
In the body type:
	"FILE /internet-drafts/draft-ietf-webdav-quota-02.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.
		
		
Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

--NextPart
Content-Type: Multipart/Alternative; Boundary="OtherAccess"

--OtherAccess
Content-Type: Message/External-body;
	access-type="mail-server";
	server="mailserv@ietf.org"

Content-Type: text/plain
Content-ID:	<2003-9-30152120.I-D@ietf.org>

ENCODING mime
FILE /internet-drafts/draft-ietf-webdav-quota-02.txt

--OtherAccess
Content-Type: Message/External-body;
	name="draft-ietf-webdav-quota-02.txt";
	site="ftp.ietf.org";
	access-type="anon-ftp";
	directory="internet-drafts"

Content-Type: text/plain
Content-ID:	<2003-9-30152120.I-D@ietf.org>

--OtherAccess--

--NextPart--




